Skip to main content
VibeKit’s built-in redaction system automatically identifies and removes sensitive information from coding agent outputs by intercepting HTTP traffic through a proxy server that applies pattern-based filtering.

​
How It Works

VibeKit runs a proxy server that sits between coding agents and their API endpoints. All HTTP/HTTPS traffic flows through this proxy, where responses are processed in real-time to detect and redact sensitive data before it reaches you.

​
Proxy-based Redaction

​
Pattern Detection

The redaction system uses comprehensive pattern matching from rules-stable.yml that includes hundreds of patterns for:
  • AWS: Access keys (AKIA…), ARNs, API Gateway URLs, RDS endpoints
  • OpenAI: API keys (sk-…), organization keys, project keys
  • GitHub: Personal access tokens, app tokens
  • Google: API keys, service account keys, OAuth tokens
  • Database: Connection strings, credentials
  • Generic: Email addresses, credit card numbers, phone numbers

​
Configuration

​
Settings Management

Control redaction through the VibeKit settings:

​
Settings File

Located at ~/.vibekit/settings.json:

​
How Patterns Work

Patterns are loaded from packages/cli/src/utils/rules-stable.yml:

​
Real-time Processing

​
Stream Processing

Redaction happens as data flows through Transform streams:
  • HTTP responses are processed in chunks
  • Pattern matching occurs on buffered content
  • Sensitive data is replaced with [PATTERN_NAME_REDACTED] tokens
  • Modified responses are sent to your terminal

​
Example Output

​
Current Capabilities

​
What’s Implemented

  • Proxy Server: Intercepts HTTP/HTTPS traffic
  • Pattern Matching: 200+ predefined patterns for common secrets
  • Real-time Processing: Redacts responses as they stream
  • Settings Integration: Toggle redaction on/off
  • Multiple Agents: Works with Claude, Gemini, Codex, etc.

​
Default Patterns Include

  • AWS access keys, secret keys, ARNs
  • OpenAI API keys and organization keys
  • GitHub personal access tokens
  • Google API keys and service accounts
  • Database connection strings
  • Email addresses and phone numbers
  • Credit card patterns

​
Proxy Server Management

​
Automatic Operation

The proxy server starts automatically when needed:

​
Manual Control

​
Limitations & Current State

​
What’s Not Yet Implemented

  • Custom pattern definition through CLI
  • Redaction reporting and analytics
  • Retroactive log processing
  • Sensitivity level controls
  • Whitelist management

​
Fallback Behavior

If pattern loading fails, the system falls back to basic patterns:
  • Email addresses: [a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}
  • Credit cards: [0-9]{13,19}

​
Best Practices

​
Security

  • Keep redaction enabled in settings
  • Regularly review proxy logs for sensitive data
  • Monitor pattern matching effectiveness
  • Update VibeKit for new pattern definitions

​
Development

  • Test with dummy secrets to verify redaction works
  • Check settings periodically to ensure redaction is enabled
  • Be aware that redaction only works through the proxy server
Built-in redaction provides an essential security layer by intercepting and filtering sensitive data from AI coding agent responses, helping prevent accidental exposure of secrets and credentials.