Documentation Index
Fetch the complete documentation index at: https://pasteguard.com/docs/llms.txt
Use this file to discover all available pages before exploring further.
secrets_detection:
enabled: true
action: mask
entities:
- OPENSSH_PRIVATE_KEY
- PEM_PRIVATE_KEY
max_scan_chars: 200000
log_detected_types: true
Options
| Option | Default | Description |
|---|
enabled | true | Enable secrets detection |
action | mask | Action when secrets found |
entities | Private keys | Secret types to detect |
max_scan_chars | 200000 | Max characters to scan (0 = unlimited) |
log_detected_types | true | Log detected types (never logs content) |
Actions
| Action | Description |
|---|
mask | Replace secrets with placeholders, restore in response (default) |
block | Return HTTP 400, request never reaches OpenAI or Anthropic |
route_local | Route to local LLM (requires route mode) |
Mask (Default)
secrets_detection:
action: mask
Block
secrets_detection:
action: block
Route to Local
mode: route
secrets_detection:
action: route_local
Secret Types
Private Keys (enabled by default)
secrets_detection:
entities:
- OPENSSH_PRIVATE_KEY # -----BEGIN OPENSSH PRIVATE KEY-----
- PEM_PRIVATE_KEY # RSA, PRIVATE KEY, ENCRYPTED PRIVATE KEY
API Keys (opt-in)
secrets_detection:
entities:
- API_KEY_SK # sk-/sk_ prefix (OpenAI, Anthropic, Stripe, RevenueCat)
- API_KEY_AWS # AKIA... (20 chars)
- API_KEY_GITHUB # ghp_, gho_, ghu_, ghs_, ghr_ (40+ chars)
Tokens (opt-in)
secrets_detection:
entities:
- JWT_TOKEN # eyJ... (three base64 segments)
- BEARER_TOKEN # Bearer ... (40+ char tokens)
Environment Variables (opt-in)
secrets_detection:
entities:
- ENV_PASSWORD # DB_PASSWORD=..., ADMIN_PWD=... (8+ char values)
- ENV_SECRET # APP_SECRET=..., JWT_SECRET=... (8+ char values)
- CONNECTION_STRING # postgres://user:pass@host, mongodb://user:pass@host
Scan Roles
By default, all message roles are scanned. To scan only user-controlled content:
secrets_detection:
scan_roles:
- user
- tool
- function
| Role | Description |
|---|
user | User messages (primary source of secrets) |
assistant | Assistant responses |
system | System prompts |
tool | Tool/function call results |
function | Legacy function results (OpenAI) |
secrets_detection:
max_scan_chars: 200000 # 200KB default
# max_scan_chars: 0 # Scan entire request
