Secrets Detection

PasteGuard detects secrets before PII detection and can block, mask, or route requests containing sensitive credentials.

Supported Secret Types

All supported secret types are enabled by default.

Private Keys

Type	Pattern
`OPENSSH_PRIVATE_KEY`	`-----BEGIN OPENSSH PRIVATE KEY-----`
`PEM_PRIVATE_KEY`	`-----BEGIN RSA PRIVATE KEY-----`, etc.

API Keys

Type	Pattern
`API_KEY_SK`	`sk-...` or `sk_...` (20+ chars) - OpenAI, Anthropic, Stripe, RevenueCat
`API_KEY_AWS`	`AKIA...` (20 chars)
`API_KEY_GITHUB`	`ghp_...`, `gho_...`, `ghu_...`, `ghs_...`, `ghr_...` (40+ chars)

Tokens

Type	Pattern
`JWT_TOKEN`	`eyJ...` (three base64 segments)
`BEARER_TOKEN`	`Bearer ...` (40+ char tokens)

Environment Variables

Type	Pattern
`ENV_PASSWORD`	`DB_PASSWORD=...`, `ADMIN_PWD=...` (8+ char values)
`ENV_SECRET`	`APP_SECRET=...`, `JWT_SECRET=...` (8+ char values)
`CONNECTION_STRING`	`postgres://user:pass@host`, `mongodb://...`

Actions

Action	Description
`mask`	Replace secrets with placeholders, restore in response (default)
`block`	Return HTTP 400, request never reaches the provider
`route_local`	Route to local LLM (requires route mode)

Mask (Default)

secrets_detection:
  action: mask

Secrets are replaced with placeholders and restored in the response (like PII masking).

Block

secrets_detection:
  enabled: true
  action: block

Request is rejected with HTTP 400. The secret never reaches the provider.

Route to Local

mode: route
secrets_detection:
  action: route_local

Requests with secrets are sent to your local LLM instead.

Response Headers

When secrets are detected:

X-PasteGuard-Secrets-Detected: true
X-PasteGuard-Secrets-Types: OPENSSH_PRIVATE_KEY,API_KEY_SK

If secrets were masked:

X-PasteGuard-Secrets-Masked: true

Getting Started

Use Cases

Concepts

API Reference

Configuration

Supported Secret Types

Private Keys

API Keys

Tokens

Environment Variables

Actions

Mask (Default)

Block

Route to Local

Response Headers

​Supported Secret Types

​Private Keys

​API Keys

​Tokens

​Environment Variables

​Actions

​Mask (Default)

​Block

​Route to Local

​Response Headers

Supported Secret Types

Private Keys

API Keys

Tokens

Environment Variables

Actions

Mask (Default)

Block

Route to Local

Response Headers