Scan Secrets
Blocks on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
59 of 59 pass
In a git repo
At commit
What it does
Blocks credentials: vendor tokens (AWS, GitHub, GitLab, Slack, OpenAI, HF, ...), JWTs, private-key and PGP blocks, named key/token/secret/password values (JSON, YAML, env, HCL, code), URI creds, Authorization literals, CLI password flags; files by path (.env*, keys). Misses: split or encoded values, quoted values with spaces, unlisted names, reference- or placeholder-like values. Runs: commit, agent write, turn end. Pragma same line; agent: only if in HEAD; MCP gateway: never.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Cursor TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Codex TestedBlocks Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A staged file contains an AWS access key ID pattern.
Allowed
A commit adds a source file containing the word 'password' in a comment without a secret value.
Both examples are this policy's own test cases.
What it misses
Split or encoded values, quoted values with spaces, unlisted names, reference- or placeholder-like values.
Latest change
0.1.3 · · Hardening (SR-2d2d): a -p<password> argument is now refused for the whole mysql and mariadb client family (mysql, mysqldump, mysqladmin, mysqlsh, mysqlpump, mysqlimport, mysqlcheck, mysqlshow, mysqlslap, mysqlbinlog, mariadb and mariadb-dump, -admin, -import, -check, -show, -slap, -binlog), and sshpass keeps its -p <password> and -p<password> forms. The match stays inside the tool's own command: a pipe, ; or & ends it, so mysqldump db | ssh -p2222 host and mysqldump db && tar -pxzf a.tar no longer read the next command's -p as a password. -p on mkdir, ssh, tar and cp was never matched. A mysql-family -p followed by a separate word is a prompt plus a database name, so it stays allowed. Tests: test_scan_secrets_sr2d2.py; eval case tc-059.