Secrets

Secrets are kept away from the model, transcripts and model-written commands by default. There are three layers.

1. Masking known values. At startup Chanto collects real secret values from three places: secret-named environment variables (*_TOKEN, *SECRET*, *PASSWORD*, *API_KEY* and similar, plus a random-looking value in any other *_KEY; *PUBLIC_KEY and names like CACHE_KEY and SORT_KEY don't count), its own API keys, and the project's .env, .env.* and .dev.vars files. Example files like .env.example are skipped, and changed files are re-read each turn. Sign-in tokens Chanto gets while running (chanto login OAuth tokens, MCP servers' OAuth tokens) are added as they're used, and a background run also masks the values in its source checkout's env files, which its worktree doesn't have. Those exact values, plus their base64 and URL-encoded forms, are replaced with [REDACTED:NAME] in everything sent to the model (every request: turns, compaction summaries, hook and classifier checks and other side calls) and in saved sessions. That covers tool output, file contents, your own messages and tool-call arguments. What leaves the session is masked too: --output-format stream-json events, the web UI and /remote (events, permission prompts and questions, transcripts, checkpoints and the message queue), background runs' event logs, and what a runner sends its server (including a run's script output). Streamed answer text is masked one piece at a time, so a known value the model writes split across two pieces could show; the model only ever sees masked values, so it can't repeat one it wasn't shown. If you paste a secret into a message, Chanto warns you that it was masked.
2. Masking known formats. Common token formats are masked even when Chanto doesn't know the value:
   • AWS, GitHub, GitLab, Slack, Stripe, OpenAI, Anthropic, Google, npm, PyPI, Hugging Face, SendGrid and DigitalOcean tokens;
   • private keys and JWTs;
   • passwords in URLs and bearer tokens;
   • random-looking values assigned to secret-named keys.
3. Prevention:
   • Secret files need your approval. Reading or editing .env files, keys and certificates (*.pem, *.key, id_rsa), ~/.ssh, ~/.aws, ~/.netrc, ~/.docker/config.json, ~/.kube/config and similar asks first in every mode except bypass, and so does a shell command that mentions one.
   • Secret variables are withheld from commands. Secret-named environment variables aren't passed to shell commands the model runs (any *_KEY counts here, whatever its value; list one in pass_env if a tool needs it). On Linux, Chanto also marks its own process non-dumpable, so a command can't read them back from /proc/<chanto's pid>/environ or attach to Chanto. This also means Chanto leaves no core dump, and gdb -p, strace -p and similar tools can't attach to a running Chanto without root.

[secrets]
redact = true          # layers 1 and 2
protect_files = true   # ask before secret files are read or changed
scrub_env = true       # withhold secret-named variables from shell commands
pass_env = ["GH_TOKEN", "AWS_*"]   # ...except these (names or prefix*), if your tools need them

To let the agent read one specific file without asking, add an allow rule such as Read(./.env.test). Project config can't weaken these settings unless you trust the project.