Secret redaction
Mask coding-agent secrets before they hit disk
Coding agents can echo keys, tokens, and environment values in tool output, diffs, or command text. ActraDeck applies redaction before persistence so the cockpit and audit trail keep useful context with detected secret patterns masked to markers and per-kind counts.
What is stored
ActraDeck stores redaction markers and per-kind counts in place of each masked value. The UI can show that a GitHub token or credential assignment was detected without exposing the masked value.
Two redaction floors
Events that pass through the sidecar are redacted at the sidecar choke point. Events posted directly through the public ingestion contract are redacted again at backend ingress before the database write.
Honest limit
Redaction is best-effort pattern matching, not a mathematical guarantee. It is built to reduce accidental retention and make leaks visible through counts, while the local trust boundary remains a single-operator machine.