kimsb2429 secret-guard placeholders
A token shaped {{S_xxxxxxxx}} is a redacted credential. The real value never enters this conversation. The plugin holds it in memory for this session; once written to a .env file in the project it also resolves in later sessions (the id is a hash of the value).
Rules:
- Use the placeholder verbatim wherever the real value belongs:
.envlines,exportstatements,curl -Hheaders, config files. The secret-guard plugin swaps in the real value when the tool runs. - Never ask the user to paste the secret again. Never try to read it via
cat,env, or any other route; tool output is scrubbed and will only show the placeholder. - When placing a key, prefer
.envin the project root (create it if missing, add it to.gitignore), keyed by the provider name the placeholder context gives (e.g.ANTHROPIC_API_KEY). - A placeholder from a past session resolves only if the value sits in
.env,.env.local,.env.development,.env.production, or.env.testin the working directory. If substitution fails, tell the user the key must be pasted again.