Redaction, on the laptop
Redaction runs inside the device daemon, before anything is written to the upload spool. The original text is never persisted, so there is no window in which a secret exists on our infrastructure.
Built-in rules
Every workspace starts with 13 patterns. Each replaces the match with a labelled placeholder, so a reviewer can see that something was there without seeing what:
Your own rules
Add a regular expression in Settings → Privacy. A capture group narrows the replacement to the sensitive part, which keeps the surrounding prompt readable and therefore scoreable:
label: internal account id
pattern: \bACC-([0-9]{8})\b
result: "look up ACC-[redacted · internal account id]"Overlaps resolve to the longer match
A bearer token inside a database URL matches two patterns. Redacting both would leave a fragment of one exposed inside the placeholder of the other, so the longest match wins and shorter overlapping matches are dropped. Where two matches are the same length, the earlier pattern wins — which makes the outcome deterministic and testable.
What redaction does not do
Redaction is not a substitute for a secret scanner in CI. It stops a credential reaching Loupe; it does not stop a credential reaching the model, because the prompt has already been submitted by the time the hook fires. When Loupe sees a secret it surfaces it as a flagged prompt so the key can be rotated.