transcript-redactor

A key that reaches the conversation is in the transcript for good. It goes to the model on every turn after, sits in the session file on disk, and is replayed into every fork and subagent. The only fix is to never let it in, and keys get in more ways than you'd think: you paste one, a tool prints one, a file you @ mention holds one, or CLAUDE.md does.

What it does

transcript-redactor swaps every key it finds for a placeholder like [REDACTED-SECRET-5c1e9a7b]. Claude works with the placeholder, and it turns back into the real key when a command runs on your machine.

• On the way in. A key in your prompt, in CLAUDE.md, in an @ file or in a hook's context is swapped before Claude reads it.
• On the way out. Every tool result is scanned. A cat .env shows PORT=3000 and a placeholder for the key.
• Real values where they run. When Claude writes a placeholder into a Bash command or a file, the real key goes back in first, so a curl with Authorization: Bearer [REDACTED-SECRET-5c1e9a7b] really authenticates.
• Same key, same placeholder. Claude can still tell two keys apart, and you can still say "use the Stripe key".

Using it

There's nothing to call. It runs on every turn. A tool row says transcript-redactor: hid 1 value(s) when something was swapped, and a toast says the same for your prompt. Ask Claude to use a key by its placeholder or its name.

What it hides and what it keeps

A value is hidden if it matches about 70 vendor key formats (sk-ant-, ghp_, AKIA and the rest), a JWT, a private key block or a password in a postgres:// URL. It also catches high-entropy tokens, base64 that hides a key, and shorter tokens right after a name like API_KEY=.

It keeps things that would only add noise: Stripe public ids like price_, names in code and bare 40-character hex, which is a git SHA far more often than a key.

Settings

Set them with /plugin configure transcript-redactor@claude-code-mods or under pluginConfigs.

• secrets (on): hide secrets.
• pii (off): also hide email addresses and public IPs. hideEmails turns the email part off.
• restoreTools: the tools that may get a real value. WebFetch and MCP tools are left out on purpose.
• minEntropy (3.6): raise it to hide less.
• allow, allowEmails, allowPrefixes: things never to hide.

How it works

Six hooks share one vault: prompt.submit, prompt.context, tool.call, prompt.attachment, prompt.mention and agent.spawn. The vault maps each value to a random placeholder, lives in memory only and is never written to disk. Every hook fails closed: if a scan breaks, nothing goes through unscanned.

Which one do I need?

secret-box is this mod plus a way to hand Claude a new key: a masked box that saves it to .env, .env values hidden by name and a guard that refuses to commit .env. Run one or the other, not both.

Limits

• It hides what Claude reads, not what Claude does.
• A plain word password with no name beside it is missed.
• Bash restores anywhere in the command, including a curl to any host. Take it out of restoreTools if you'd rather it didn't.
• Files Claude writes get the real key.
• The vault is memory only, so placeholders mean nothing in a new session.