Secrets Detection - PasteGuard

PasteGuard detects secrets before PII detection and can block, mask, or route requests containing sensitive credentials.

Supported Secret Types

All supported secret types are enabled by default.

Type	Pattern
`OPENSSH_PRIVATE_KEY`	`-----BEGIN OPENSSH PRIVATE KEY-----`
`PEM_PRIVATE_KEY`	`-----BEGIN RSA PRIVATE KEY-----`, etc.

Type	Pattern
`API_KEY_SK`	`sk-...` or `sk_...` (20+ chars) - OpenAI, Anthropic, Stripe, RevenueCat
`API_KEY_AWS`	`AKIA...` (20 chars)
`API_KEY_GITHUB`	`ghp_...`, `gho_...`, `ghu_...`, `ghs_...`, `ghr_...` (40+ chars)

Type	Pattern
`JWT_TOKEN`	`eyJ...` (three base64 segments)
`BEARER_TOKEN`	`Bearer ...` (40+ char tokens)

Type	Pattern
`ENV_PASSWORD`	`DB_PASSWORD=...`, `ADMIN_PWD=...` (8+ char values)
`ENV_SECRET`	`APP_SECRET=...`, `JWT_SECRET=...` (8+ char values)
`CONNECTION_STRING`	`postgres://user:pass@host`, `mongodb://...`

Action	Description
`mask`	Replace secrets with placeholders, restore in response (default)
`block`	Return HTTP 400, request never reaches the provider
`route_local`	Route to local LLM (requires route mode)

secrets_detection:
  action: mask

Secrets are replaced with placeholders and restored in the response (like PII masking).

secrets_detection:
  enabled: true
  action: block

Request is rejected with HTTP 400. The secret never reaches the provider.

mode: route
secrets_detection:
  action: route_local

Requests with secrets are sent to your local LLM instead.

When secrets are detected:

X-PasteGuard-Secrets-Detected: true
X-PasteGuard-Secrets-Types: OPENSSH_PRIVATE_KEY,API_KEY_SK

If secrets were masked:

X-PasteGuard-Secrets-Masked: true