[aisona-lab]

What

guardrails.json declared never_send_secrets_to_llm: true and listed redact_patterns, but no code applied them. A diff with a hardcoded key went verbatim into the API prompt, and in agent mode into packet.json. That broke hard rule #2 in AGENTS.md.

lazycoder.redact.redact_secrets now runs at the only two exits: SingleRuleReviewer._build_prompt and agent_mode.build_packet. It replaces three kinds of value with <redacted:secret>:

• known token formats: Anthropic/OpenAI sk-…, GitHub ghp_/github_pat_, AWS AKIA…, Slack xox?-, Google AIza…;
• private-key bodies between -----BEGIN … PRIVATE KEY----- and END;
• string literals of 8+ non-space characters assigned to names containing api_key, secret, token, password/passwd or private_key.

Design choices

• Line for line. Redaction runs on the numbered text that is sent out, never on the copy used to validate citations. Line numbers don't move.
• The marker keeps the evidence. R7 can still say "a credential is hardcoded here" without seeing it. The prompt and the packet instructions explain the marker.
• Short or spaced values are left alone (token_type = "bearer", prose, os.environ[...]), so masking can't invite a false R7.
• Config and code stay in step. A test checks that every name in guardrails.json redact_patterns gets masked.

Proof

env -u ANTHROPIC_API_KEY uv run pytest -q          # 189 passed
ruff check . && black --check . && mypy src        # clean

On real code, 0 redactions across the 37 corpus hunks and the 13 fixtures, so no false positives on what we measure.

Known limit: detection is pattern-based, so a secret in an unusual shape can still get through. The README says so.

---

Generated by Claude Code