@normful/pi-stop-secrets-leaks0.3.0
Pi extension that helps prevent secrets from leaking
Untested on omp
This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.
Reports 0
No reports yet.
Readme
@normful/pi-stop-secrets-leaks
Pi extension that detects secrets using betterleaks and redacts them by position before they reach the LLM.
- Project files — scanned at session start via
betterleaks dir - Environment variables — scanned at session start via
betterleaks stdin - Tool result text — scanned reactively on each tool call
Secret values are never stored or logged. All betterleaks invocations use
--redact=100; only metadata (positions, rule IDs, fingerprints) is kept.
Redacted spans are replaced with opaque «🔒 $S_NN» placeholders.
Installation
Install betterleaks. Then:
pi install npm:@normful/pi-stop-secrets-leaks
Commands
| Command | Description |
|---|---|
/stop-secrets-leaks-status |
Show extension status and finding counts |
/stop-secrets-leaks-toggle |
Enable or disable redaction |
/stop-secrets-leaks-rescan |
Re-scan project and environment |
/stop-secrets-leaks-config |
Set the betterleaks scan timeout |
Warning
This isn't a 100% guaranteed way of preventing all secrets from leaking to the LLM. Stack this with other countermeasures and secrets management tools to further reduce likelihood of leaked secrets.
Inspiration
This extension is inspired by these similar Pi extensions: