Day 64: Secret-Aware Context Filters

Models will cheerfully “fix” a leaked AWS key by pasting it into the next file. Secret-aware context filters strip or hash secrets before they enter the prompt, and block apply if the model tries to re-emit them.

⚡ TL;DR: Scan diffs and file reads with detectors (AKIA, PEM, Slack tokens). Replace with stable placeholders. Refuse tool outputs that reintroduce live secrets. Prefer Secrets Manager handles.

Filter on the way in

# filters/secrets.py
import re

PATTERNS = [
    (re.compile(r"AKIA[0-9A-Z]{16}"), "AWS_KEY_ID"),
    (re.compile(r"-----BEGIN (RSA |EC )?PRIVATE KEY-----"), "PRIVATE_KEY"),
    (re.compile(r"xox[baprs]-[0-9A-Za-z-]{10,}"), "SLACK_TOKEN"),
]

def redact(text: str) -> str:
    out = text
    for rx, name in PATTERNS:
        out = rx.sub(f"[REDACTED:{name}]", out)
    return out

export function readFileForModel(path: string, raw: string): string {
  return redact(raw); // ✅ model never sees live key material
}

Filter on the way out

def assert_no_secrets(model_out: str):
    for rx, name in PATTERNS:
        if rx.search(model_out):
            raise RuntimeError(f"secret_egress:{name}")

❌ “The model needs the real key to rotate it” — use a secrets manager tool with server-side handle, not raw values in context.

Closing checklist

• [ ] Redact on read into context
• [ ] Block secret egress in model output
• [ ] Prefer SM/Parameter Store handles
• [ ] Keep detector pack versioned
• [ ] Alert on egress blocks

Series navigation

Day 63: IAM for Agents: Roles, Not God Keys · Day 65: PII Redaction Before Embeddings

Last updated September 11, 2026