Secrets Detection¶

SecretsDetector scans text for 37+ credential patterns and prevents accidental secret leakage into logs, audit trails, provider API payloads, and chat output. SecretCensor (the redaction layer) replaces detected secrets with [REDACTED].

Detection Pipeline¶

graph LR
    A[Input Text] --> B[SecretsDetector.scan]
    B --> C{Findings?}
    C -->|Yes| D[Sort by position]
    D --> E[Merge overlapping spans]
    E --> F["Replace with [REDACTED]"]
    C -->|No| G[Pass through unchanged]

Detected Credential Types¶

The detector covers 37+ distinct credential patterns across major cloud providers, SaaS platforms, and common secret formats.

Cloud Providers¶

AI Providers¶

Code Hosting and CI/CD¶

Communication and SaaS¶

Infrastructure and Databases¶

Cryptographic Material¶

Observability and Monitoring¶

Generic Patterns¶

Overlap Merging¶

When multiple patterns match overlapping regions of text, the detector merges spans before redaction to prevent partial secret leakage:

Text:    "api_key=sk-ant-api03-very-long-key-here"
Match 1: [--------api_key match--------]
Match 2:         [---anthropic_key match---]
Merged:  [----------single span-----------]
Result:  "[REDACTED]"

Without merging, overlapping replacements could leave fragments of the secret visible.

Usage¶

Scanning¶

from missy.security.secrets import secrets_detector

findings = secrets_detector.scan(text)
# Returns: [
#   {"type": "anthropic_key", "match_start": 42, "match_end": 89},
#   {"type": "api_key", "match_start": 42, "match_end": 85},
# ]

Redaction¶

safe_text = secrets_detector.redact(text)
# All detected secrets replaced with [REDACTED]

Quick Check¶

if secrets_detector.has_secrets(text):
    # Short-circuit: stops at first match
    handle_secret_detected()

Module Singleton¶

The secrets_detector instance is a process-level singleton. Import and use directly:

from missy.security.secrets import secrets_detector

Integration Points¶

The secrets detector is used at multiple points in Missy's processing pipeline: