Redacting Session History · node9 documentation
Redacting Session History
Secrets that are already sitting in local session files, and how to take them out.
Agents write their conversations to disk. A key that appeared in one is still in that file long after the conversation ended, and it is in plain text. This finds those and redacts them in place.
Look first
node9 dlp # what was detected node9 mask --dry-run # what would be redacted
--dry-run changes nothing. Run it before the real pass, so the first time you edit history you already know what it will touch.Redact
node9 mask # last 30 days node9 mask --all # everything on diskRewrites the files with the secrets removed.
This cleans the record, not the exposure
A secret that reached a session file also reached the model provider that produced the reply. Redacting the file makes the copy on your disk safe and does nothing about the copy that already left. If a live credential turns up here, rotate it; the redaction is housekeeping done afterwards.