Mask secrets in sync errors and diffs — how Aura redacts before they leak

Aura's redact pipeline strips API keys, JWTs, and dotenv values out of sync errors, diffs, and agent prompts before they leave the machine. Pattern set + custom rules.

When an AI coding agent fails a sync, the failure log is gold for debugging — and a goldmine for accidental credential leaks. Aura masks secrets in sync errors and diffs before any line is written to disk, sent to the cloud, or shown to an LLM.

What gets masked, by default

  • AWS access keys (AKIA…), secret keys, session tokens.
  • Google / GCP service account keys, OAuth refresh tokens.
  • Stripe live + test keys (sk_live_, sk_test_, rk_live_).
  • GitHub, GitLab, Bitbucket personal access tokens (ghp_, glpat-, etc.).
  • Generic high-entropy strings > 32 chars matching the JWT three-segment shape.
  • Anything matching a value in a .env, .env.local, or .envrc the agent can see.

Where masking runs

The redact pipeline sits in front of three sinks:

  1. Sync error log — every line emitted by aura live sync push / pull is filtered through the redactor before println!.
  2. Diff payload — aura_pr_review and aura attest verify redact diff hunks before sending them to the LLM that scores them.
  3. Cloud uploads — anything written to /api/v2/* (rotation chains, intent blocks, sentinel events) is redacted on the client side, not the server. The server never sees the raw secret to begin with.

Adding custom patterns

# .aura/redact.toml
[[pattern]]
name  = "internal-pagerduty-key"
regex = "(?i)pd_(test|live)_[a-z0-9]{32}"
mask  = "pd_***"

[[pattern]]
name  = "customer-bearer"
regex = "Bearer\s+[A-Za-z0-9._-]{60,}"
mask  = "Bearer ***"

Why client-side, not server-side

A redactor that runs on the cloud server is a redactor that has already been handed your secret. Aura redacts before the bytes leave your machine — the threat model assumes the cloud is honest-but-curious, and the CLI never trusts it with anything it wouldn't show in git diff.