---
title: "Redact secrets from agent session logs · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs
id: AID-76
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1032
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Redact secrets from agent session logs

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-76
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Agent session logs pass a redaction step before they leave the developer's machine or the runner. Keys, tokens and passwords never reach the log store in clear text.
- Check: Start a session that runs `echo sk_live_TESTONLY000000000000`. Within five minutes the log store shows the command with the key masked. A daily secret scan of the log store finds no key, or opens a ticket naming it.
- Risk: Data leaked or lost
- How: Logged commands carry what the agent typed, and agents paste keys into commands, such as `curl -H "Authorization: Bearer …"`. Log only what the [activity log](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log.md) needs. Keep prompts, tool output and raw API bodies off unless you are debugging. In Claude Code these are off by default. Run every export through a collector that masks known key shapes, such as the OpenTelemetry Collector's redaction processor. Mask by value patterns, such as `sk_live_`, `ghp_` and `AKIA`, and by key names that contain `token` or `secret`. Then scan the stored logs with a secret scanner each day, and rotate any key it finds. The same idea for app logs is [Keep personal data and secrets out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
processors:
  redaction:
    allow_all_keys: true
    blocked_key_patterns: [".*token.*", ".*secret.*", ".*password.*"]
    blocked_values:
      - "sk_live_[A-Za-z0-9]+"
      - "gh[pousr]_[A-Za-z0-9]{36,}"
      - "AKIA[0-9A-Z]{16}"
```

### Python example

```python
import re

SECRET_SHAPES = re.compile(r"sk_live_[A-Za-z0-9]+|gh[pousr]_[A-Za-z0-9]{36,}|AKIA[0-9A-Z]{16}")

def mask_secrets(line: str) -> str:
    return SECRET_SHAPES.sub("****", line)
```

### JavaScript example

```js
const SECRET_SHAPES = /sk_live_[A-Za-z0-9]+|gh[pousr]_[A-Za-z0-9]{36,}|AKIA[0-9A-Z]{16}/g;

const maskSecrets = line => line.replace(SECRET_SHAPES, '****');
```

## Sources

- [Claude Code monitoring](https://code.claude.com/docs/en/monitoring-usage)
- [OpenTelemetry Collector redaction processor](https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/redactionprocessor)
- [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

## Related rules

- AID-34 [Log what every agent session does](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log.md) in AI-assisted development
- OPS-9 [Keep personal data out of logs](https://agentwranglers.se/playbook/operations/logs/logs-without-personal-data.md) in Operations and observability

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/redact-agent-logs">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Log what every agent session does](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-activity-log.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)