What SafePrompt detects: keys, PII, secrets, and limits

End users often ask: “What exactly gets redacted?” This page lists the major categories, example shapes, and honest limits so you know what SafePrompt covers and what still needs your attention.

Category 1 — API keys

These usually become [API_KEY].

• AWS access key IDs: AKIA… and ASIA…
• OpenAI-style keys: sk-… (non-Stripe forms)
• Anthropic: sk-ant-…
• Google API keys: AIza…
• GitHub tokens: ghp_, gho_, ghs_, etc.
• Slack tokens: xoxb-, xoxp-, and similar
• Stripe secrets: sk_live_, sk_test_, rk_…

Category 2 — PII

These usually become [PII].

• Email addresses: name@example.com
• Phone numbers: formats like +1 (555) 123-4567
• Credit cards: Visa/Mastercard-shaped numbers that also pass Luhn checks (for example 4111111111111111)

In Balanced mode, some card-like numbers near invoice/payment words may be skipped to reduce false alarms. Strict mode is stricter.

Category 3 — Secrets

These usually become [SECRET].

• Private key blocks: BEGIN PRIVATE KEY / RSA / OpenSSH
• Bearer tokens: Bearer eyJ… style values
• AWS secret access keys: long random strings when AWS context is nearby (labels like aws_secret_access_key)

What SafePrompt may miss (be careful)

• Custom internal tokens with no known prefix
• Passwords that look like normal words
• Secrets split across many lines in unusual formats
• Images/screenshots (text inside images is not scanned)
• Secrets typed after you click Allow once
• New cloud key formats we have not added yet

False positives — when SafePrompt might over-block

• Long random IDs that look like tokens
• Sample keys in documentation (you can whitelist exact phrases)
• Some phone-like number strings in dense digit text

Fix options: Undo, whitelist the exact safe phrase, or disable one rule in Advanced settings.

Stats categories in the popup

• API Keys
• PII
• Secrets

Privacy reminder for detections

Counts are stored locally. SafePrompt does not keep a history of the actual secret strings for the dashboard.

Need a detector added?

Email safeprompt.help@gmail.com with the key type (no real secrets) and we can consider it for a future update.