Skip to main content
Coding-agent traces carry live credentials: a key pasted into a prompt, an .env file a tool read, a connection string in a stack trace. Redaction runs in the ingestion pipeline, before storage, and replaces each credential it recognizes with a [SECRET] marker. The text around the marker stays intact, and detection uses three layers, from exact vendor rules to context. It is on by default. A data privacy rule can turn redaction off for its scope.

​
How detection works

Three layers, from exact to contextual:
  1. Known vendors. Keys with a recognized prefix: AWS, GitHub, OpenAI, Anthropic, Slack, Google, Stripe, plus JWTs, private key blocks, database connection-string passwords and bearer tokens.
  2. Shape. A vendor-style prefix followed by a high-entropy body is redacted even when the vendor has no built-in rule, so a key from a provider with no rule of its own is still caught.
  3. Context. A credential named in prose and then given a value, for example “the admin password is …”, is redacted from the naming alone. Values under obviously sensitive attribute names such as authorization are covered the same way.
Layers 2 and 3 only fire when the value’s entropy and character mix look like a real credential, because over-redaction is treated as a bug of the same severity as a leak: ordinary identifiers, commit hashes and UUIDs stay readable, and a placeholder such as YOUR_API_KEY is left alone. One credential produces one marker. LangWatch scans large payloads in slices within the ingestion budget, and still catches a credential that straddles a slice boundary.

​
The marker

The replacement is typed: [SECRET], not a generic blank. In the trace view you see that a credential was scrubbed at this spot, and the secrets evaluator can still count leaks even though the value itself is gone.

​
Custom patterns

Add company-specific token shapes, for example acme_live_..., as regular expressions on a data privacy rule under Settings → Data privacy. LangWatch rejects a pattern that risks catastrophic backtracking when you save the rule. Patterns add up across scopes: a team’s patterns apply on top of the organization’s.

​
Turning it off

A data privacy rule can disable secrets redaction for its scope.
With secrets redaction off, any credential pasted into a prompt or returned by a tool is stored in the clear. Turn it off only when you are certain no real credentials transit the projects in scope.

​
The CLI scrubs locally too

langwatch report, the command that sends an issue report to LangWatch, runs the same redaction rules on the title, summary and transcript on your machine, before anything is uploaded. Run it with --dry-run to read exactly what would leave. Also check: Privacy for who can read what, and Data privacy policy for PII redaction and the drop controls.
Last modified on October 12, 2026