Pack

`secrets-safe`

Deny credential-path exfil; require approval for project .env reads.

Default effect: deny exfil / approve .env

Extend in policy

extends:
  - pack: secrets-safe

Blocks secrets.exfil capabilities and redirect tricks toward ssh/aws/gnupg/kube/history/cookie/key paths. Project-local .env* is require_approval rather than silent allow.

All packs · Policy docs · Source YAML