> For the complete documentation index, see [llms.txt](https://evo-5.gitbook.io/evo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://evo-5.gitbook.io/evo/concepts/credential-scanning.md).

# Credential Scanning

evo scans content for credential-like patterns before writing to disk. This prevents accidental persistence of secrets, API keys, tokens, and other sensitive data in skill files, lessons, or memory catalogs.

## How It Works

When evo writes content via:

* `materializeSkill` (SKILL.md and .memory.md files)
* `updateCatalog` (AGENT\_MEMORY.md)
* `reflectBatch` (memory and skill content)
* `useSkill` (lesson text)

The content is scanned for credential patterns. If a match is found:

1. The write is **skipped** (not thrown)
2. A warning is logged with redacted preview
3. The calling operation continues without the sensitive content

## Detected Patterns

| Type            | Examples                                                                |
| --------------- | ----------------------------------------------------------------------- |
| Private Keys    | PEM blocks (RSA, EC, OpenSSH)                                           |
| API Keys        | `sk-*`, `AIza*`, `ghp_*`, `gho_*`, `xox*-*`, `AKIA*`, `npm_*`, `pypi-*` |
| Tokens          | Bearer tokens, authorization headers                                    |
| Passwords       | Password/passwd/pwd assignment patterns                                 |
| JWT             | Base64-encoded JWT tokens                                               |
| Encoded Secrets | Long base64 strings                                                     |

## Fixture Detection

Test and placeholder values are automatically allowed:

* `sk-test-*`, `sk-fake-*`, `sk-mock-*`
* `test-api-key`, `fake-token`, `YOUR_API_KEY_HERE`
* Known example keys like `AKIAIOSFODNN7EXAMPLE`
* Repeated characters (`xxx...`, `000...`, `aaa...`)

## Configuration

The scanner is enabled by default with no configuration required. Logging uses `console.warn` and can be observed in the host process logs.

## Testing

To verify credential scanning in tests, use the logger override:

```typescript
import { setCredentialSkipLogger } from 'evo/workspace/skill-materializer'

it('skips writing credentials', () => {
  const logs: string[] = []
  const restore = setCredentialSkipLogger((ctx) => logs.push(ctx))
  
  try {
    materializeSkill(cwd, skillWithSecret, [])
    expect(logs).toContain('skill/secret-skill/body')
  } finally {
    restore()
  }
})
```

## Best Practices

1. **Never hardcode secrets** in skill steps or lessons
2. **Use environment variables** for configuration that varies
3. **Test with fixture keys** that are clearly fake
4. Review warnings in logs for unintended credential exposure


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://evo-5.gitbook.io/evo/concepts/credential-scanning.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.