Register a secret value. Values shorter than 4 characters are ignored because scrubbing them would corrupt ordinary text.
secret value
Forget a secret value (e.g. an expired token).
secret value
Replace registered secret values and credential-looking patterns.
text to scrub
scrubbed text
Replace only registered secret values (no heuristics), for data such as API results where pattern-based scrubbing could corrupt content.
text to scrub
scrubbed text
Registry of secret values known to the process (upstream credentials, issued upstream tokens, MCP bearer tokens). Every outbound string is scrubbed against it.