Secret-redaction boundary

What Celeborn replaces

Capture and sync replace text matching the configured secret_patterns detectors with [REDACTED:<type>] before it is written to the Automatic Context Record or uploaded. The defaults recognize several common credential shapes, including JWTs and selected Stripe, Vercel, Supabase, Resend, Anthropic, GitHub, AWS, Slack, Google, xAI, and private-key formats.

This is pattern matching, not a guarantee that sensitive data is absent.

What it does not promise

• Unknown or new token formats are missed unless a detector is added.
• Generic passwords and assignments, PII, customer data, and sensitive prose are not classified.
• Sensitive paths are not scrubbed; capture copies paths, commit summaries, and test summaries unchanged.
• A project .celebornrc secret_patterns value replaces the defaults wholesale. Custom formats need custom patterns, and an incomplete override can remove newer coverage.
• Regex detection can produce false negatives and false positives.

What you should do

Do not paste credentials, passwords, personal data, or customer data into prompts or support chat. Run celeborn doctor for the available pattern-based scan. If a credential may have been recorded, rotate it and remove it from the source. Broader transcript scanning and in-place remediation are tracked as CELE-t1308 and CELE-t1309.

Separate narrow guarantees still stand. Vault values read through stdin do not enter command arguments, and architecture sync omits its parsed credentials block rather than trusting regexes.

Questions? Open support—without pasting the sensitive value.