Redaction and privacy
What is removed on your machine, what is removed on ours, and what no redactor can promise.
Redaction happens twice. The first pass runs inside the CLI before any upload. The second runs on our servers after upload and before a trace can be listed.
Every redacted span is replaced with a marker that names its kind, for example [REDACTED:openai_key] or [REDACTED:email]. The original text is discarded, not stored next to the marker.
On your machine
| Group | Kinds |
|---|---|
| Provider keys | anthropic_key, openai_key, aws_access_key, aws_secret_key, github_token, gitlab_token, gcp_api_key, google_oauth_token, slack_token, slack_webhook, stripe_key, vercel_token, npm_token, huggingface_token, sendgrid_key |
| Generic secrets | private_key, jwt, bearer_token, basic_auth, url_password, env_secret, high_entropy |
| Personal data | email, phone, ssn, credit_card, street_address, full_name |
| Machine identity | home_path, username, hostname, ipv4, ipv6 |
| Your rules | blocked_term |
The dry run reports counts per kind. It never prints the matched text.
On our servers
- A second scan with a larger rule set and stricter entropy checks.
- Traces where risky content remains are rejected. We do not edit them by hand.
- Very short sessions and near-duplicates are dropped.
- Each trace gets a quality score that affects whether and how it is listed.
The dashboard shows client and server redaction counts for every trace.
What redaction cannot do
Be clear-eyed about this before you approve a project.
- Unusual secrets slip through. A password in an odd format, a key from a provider we do not know, or a secret split across lines can be missed by both passes.
- Confidential code is not a pattern. Redaction cannot tell whether an algorithm, schema or business rule is a trade secret. That judgment is yours, which is why projects start as pending.
- Context can identify you. A distinctive bug, a rare stack, or a description of your company in plain prose can point back to you or your employer even with names removed.
- Names are hard.
full_namedetection catches common patterns, not every name in every language.
If a project contains anything you would not want a stranger to read, mark it private. Add client names and codenames as blocked terms.
If something slipped through
Exclude the trace right away with selltraces exclude <traceId> or from the dashboard, and email hi@selltraces.ai. If the trace has not been sold, we delete it. If it was part of a sale, we contact the buyer and ask them to delete it under the license terms. Rotate any exposed secret either way.