You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[feature request] Remove confidential data from sending context #6
Is it possible to remove the values of variables, keys and tokens obtained from files before sending a request to the cloud? Alternatively, rather than removing them, could they be masked?
Shipped in #19 (v0.8.9). Tamp now masks secrets in tool output before any stage sees it (so they never reach the upstream, the off-box textpress/llmlingua stages, or the disk caches).
Covers provider-shaped keys (AWS, GitHub, Anthropic/OpenAI, Google, Slack, Stripe), JWTs, PEM private-key blocks, and UPPER_SNAKE secret assignments from .env/shell.
Two modes: TAMP_REDACT_MODE=mask (default — API_TOKEN=‹redacted:secret›, keeps structure so the model still reasons) or remove (deletes the value).
On by default at every compression level; TAMP_REDACT=false to disable.
Detection favors precision over recall, so it won't catch every secret shape — treat your upstream's data policy as the final boundary. Thanks for the request, @mrMemfis.
Activity
feat: redact secrets from outbound context (closes #6) (#19)
sliday commentedon Jun 29, 2026
Shipped in #19 (v0.8.9). Tamp now masks secrets in tool output before any stage sees it (so they never reach the upstream, the off-box
textpress/llmlinguastages, or the disk caches).UPPER_SNAKEsecret assignments from.env/shell.TAMP_REDACT_MODE=mask(default —API_TOKEN=‹redacted:secret›, keeps structure so the model still reasons) orremove(deletes the value).TAMP_REDACT=falseto disable.Detection favors precision over recall, so it won't catch every secret shape — treat your upstream's data policy as the final boundary. Thanks for the request, @mrMemfis.
feat: redact secrets from outbound context (closes sliday#6) (sliday#19)