Agent configs and billing exports often contain secrets: API keys, account IDs, internal service names. So when I built Arup Banerjee Labs, I set o...
For further actions, you may consider blocking this person and/or reporting abuse
the devtools network tab test is the strongest part of this. "we never see your data" is usually a vibe, making it verifiable is what makes it real.
of the three, the agent health checker is the one i'd reach for first. secrets-in-config and injection-prone tool sinks are the checks that actually bite people, the rest is nice to have.
one thing i'd think about: if the feedback loop for wrong checks lives in github issues, someone will eventually paste a config with a live key into a "this flagged nothing" report. the privacy story is airtight on the tool side, the report side is the leakier surface.
Thanks Om, this is really useful. Agreed that secrets-in-config and injection-prone tool sinks are the checks that bite. And you're right, the report side is the leakier surface. I'm going to add a clear "redact keys and tokens before you paste" warning to the GitHub issue template so nobody drops a live key into a report.
nice, glad that landed. the template warning is exactly the fix i'd have suggested, catches people at the point of paste instead of after. though i'd bet the next leakier-than-expected surface is people pasting their scorecards into a chatbot to "explain my bill". one hole at a time.
Ha, good call. The scorecard Markdown is meant to stay with you — pasting it into a chatbot to explain a bill reopens the privacy hole. One hole at a time.
yeah, we're converging on the same fixes. the annoying bit is the ordering: people do the careful local thing, then paste the raw scorecard into a chatbot for "explain my bill". the template warning catches github reports, a one-liner in the scorecard itself would catch the artifact that actually travels.
Yep — the issue template catches the report path, but the Markdown export is what people actually carry around. I'll put a one-liner on the scorecard itself so the warning travels with the artifact.