secret-redactor

secret-redactor keeps three kinds of value out of the session transcript: secrets, email addresses and IP addresses. Each one is swapped for a stable placeholder such as [REDACTED-SECRET-164d0c98] before the model reads it, and swapped back for the real value on the way into a tool call, so a Bash command or a Write still carries the real key.

What it does

• Catches secrets with three tests, in order: a vendor shape (sk-ant-, ghp_, AKIA, sk_live_, JWTs, webhook URLs, private key blocks, the password inside a database URL), a long mixed-case token above an entropy floor, and a shorter high-entropy token sitting after API_KEY=, Bearer, "token": and the like.
• Leaves public ids alone: Stripe object ids, YouTube channel ids, names built out of words, charset constants, and bare hex without a key name in front.
• Hides emails and public IP addresses. Private ranges such as 127.0.0.1 and 192.168.x stay visible by default, so local URLs keep working.
• The same value always mints the same placeholder, so the model can still tell one customer from another.
• Thirteen options under pluginConfigs in your user settings: toggle secrets or PII, adjust the entropy floors, allowlist strings, emails or prefixes.

Install

Needs Claude Code 2.1.287 or later. The plugin lives in the plugins/secret-redactor folder of the author’s marketplace repository.

claude plugin marketplace add ray-amjad/awesome-claude-code-function-hooks
claude plugin install secret-redactor@awesome-claude-code-function-hooks

It works from the next session, with nothing to run. The tool row shows a count when something was hidden, and a prompt shows a toast.

How it works

Three hooks. prompt.submit catches a key you paste before it reaches the model. tool.call puts real values back into the tool’s input, then hides them again in the tool’s result, which is where a secret usually arrives: a cat .env, a Read of a config file, an API answer. prompt.context hides secrets in the blocks attached to the first message, but leaves emails there, because the engine puts your own address in that block.

The vault of real values lives in memory, inside the hooks module, for the session. Nothing is written to disk and nothing leaves the machine.

Limitations

• It does not hide a secret the model itself writes. Only what the model reads is scanned.
• The vault does not survive a restart, so placeholders from an earlier session mean nothing in a new one.