Secret controls

Why secret controls matter

AI coding agents often receive pasted code, terminal output, config files, stack traces, and repository context. Those inputs can contain secrets even when the developer did not intend to share them.

Rye secret controls evaluate model-bound traffic before it is sent upstream.

Common secret types

Policy should look for:

• Cloud access keys.
• API tokens.
• Database connection strings.
• Private keys.
• OAuth credentials.
• Webhook signing secrets.
• Customer or production identifiers.

Redact or block

Redaction is useful when the prompt can still be safely answered after the sensitive value is removed. Blocking is better when the surrounding context is itself too sensitive or when a protected file path is involved.

REDACT aws_secret_access_key in request body
BLOCK prompt containing files from src/billing/**

Operational guidance

Use blocking for protected directories and production credentials. Use redaction for accidental token exposure in logs or stack traces. In both cases, record the policy match in the audit trail so the security team can review repeated patterns.