secretslisted

# Using secrets without leaking them Anything written in this conversation is sent to the API and stored on disk in the transcript. A credential that appears here is compromised and must be rotated. This machine has an airlock so that never has to happen. **You never see secret values. You refer to them by name.** ## The rule Write `{{secret:NAME}}` anywhere in a Bash command where a credential belongs. A PreToolUse hook substitutes the real value at execution time; a PostToolUse hook scrubs it back out of the output. Your context stays clean. ```bash sshpass -p '{{secret:prod-root}}' ssh root@192.0.2.10 'uptime' mysql -u admin -p'{{secret:db-main}}' -e 'SHOW DATABASES' curl -H 'Authorization: Bearer {{secret:stripe-key}}' https://api.stripe.com/v1/charges ``` Quote the placeholder as you would quote the real value. ## Before reaching for a secret at all **Check for an SSH alias first.** Most hosts here already work with key auth and need no credential: ```bash ssh web1 'uptime' # already works — no secret involved ``` Look at `~/.ssh/config` before assuming a password is needed. A host reachable by key is strictly better than a host with a stored password. `ssh-audit-keys` lists which hosts still need one. ## When the secret is not in the vault The hook denies the command and tells you which name is missing. When that happens — or any time you are about to need a credential you do not have — **ask for it yourself, do not send the user to a terminal:** `