Nessie redacts common credential shapes before transcript/source content is persisted into indexed content slices. That means secret-looking values are replaced with [REDACTED] before they are stored for search, sync, MCP, or agent access.
Nessie currently redacts:
- GitHub classic and fine-grained tokens
- OpenAI, Anthropic, Nessie, Neon, and Supabase-style API keys
- Bearer tokens
- JWT-shaped tokens
- Database URLs for PostgreSQL, MySQL, MariaDB, MongoDB, Redis, and Rediss
- PEM private key blocks
- Common assignments such as
API_KEY=...,token=...,password=...,secret=...,database_url: ..., and JSON-style"apiKey": "..." - UUID-shaped identifiers
What redaction changes
Redaction protects the indexed copy of a transcript or source. If a coding agent pasted a secret into a conversation, the searchable/synced content slice stores [REDACTED] instead of the original value.
What redaction does not replace
Redaction is not a substitute for rotating a leaked credential. If a real API key or password appeared in any AI conversation, revoke or rotate it at the provider. Redaction reduces propagation through Nessie's search, sync, MCP, and agent surfaces; it cannot make an already-exposed secret safe again.