Secret & credential detection

The SUPERWISE® Sentinel secret and credential detection guardrail finds API keys, cloud credentials, and private tokens in a prompt and replaces each one with a placeholder before the request reaches the model provider. It works like secret scanning for code, applied to every prompt before it leaves: it matches known key and token formats, for example OpenAI, Anthropic, and Google API keys, AWS access keys, GitHub and Slack tokens, Stripe keys, JWTs, and bearer tokens.

Action: By default this guardrail remediates: each matched credential is replaced with the guardrail's replacement text, REDACTED by default, which appears in the prompt as {{REDACTED}}, and the request proceeds to the model without exposing the secret. You can change the replacement text, or switch the guardrail to block matching requests instead. See Manage guardrails.

Example interception

Inbound prompt from application:

"Hey, can you help me write a quick bash script to upload files to our S3 bucket? Here are my local env variables to test with: AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE"

What the upstream LLM actually sees:

"Hey, can you help me write a quick bash script to upload files to our S3 bucket? Here are my local env variables to test with: AWS_ACCESS_KEY_ID={{REDACTED}}"

Get Sentinel: Sentinel on superwise.ai.

See also

• PII redaction: keep personal data out of prompts.
• Rudeness & toxicity: catch hostile language.
• Manage guardrails: choose remediate or block.