Privacy and redaction

What coding.sh stores, what it removes before writing, metadata mode, and how to purge a leaked secret.

What redaction looks like

A prompt that pasted an API key, after coding.sh ingest:

coding.sh show cd0185b0

Tidy notes.txt and greet. The API key is [redacted:anthropic-key] if you need it.
  Redacted      anthropic-key 1. The agent saw these credentials: rotate them
    +0ms  user        Tidy notes.txt and greet. The API key is [redacted:anthropic-key] if you need it.

The key never reached the index, the blobs or any sink. The agent and its model provider still saw it, so the session gets the secret:exposed tag. List every session whose credentials to rotate:

coding.sh sessions --flag secret:exposed

A made-up key, like the ones in docs and test fixtures, is redacted too, but counts as placeholder-key and does not add the tag.

What is stored, and where

CODING_SH_HOME moves the folder. Outside Windows, the index, its WAL files, the blob store and the index backups are readable by your user only (files 0600, folders 0700). In full mode, the default, coding.sh keeps prompts, replies, tool calls with their input and output, file changes, errors, model names, token usage and timing.

• Nothing leaves your machine by default. With no sinks, no session data is sent. The only default network request is a daily update check to api.github.com (or registry.npmjs.org), which you can turn off: see Install.
• The viewer listens on 127.0.0.1 and needs the token in the URL it prints.
• A repo's own .coding.sh/config.toml can only add privacy. It can add redaction rules or switch to metadata mode, but never add a sink or move the store, so a cloned repo cannot send your sessions anywhere.

Redaction

Redaction runs at ingest, before anything is written to the index, the blobs or a sink. Each match becomes [redacted:<kind>].

# ~/.coding.sh/config.toml
[capture]
redact = ["secrets", "env", "pii"]
redactPatterns = ["CSH-[0-9]{8}"]        # your own regular expressions
exclude = ["~/work/secret-client/**"]    # never capture sessions in these folders

Metadata mode

Metadata mode keeps the structure and the numbers, with no prompts, code or tool output: ids, times, event kinds, durations, token counts, cost and short labels such as tool names.

A session sent in metadata mode has no title, so a team viewer lists it as *Untitled session*. The SDK setting drops message text and tool input and output before they leave your app's process.

Sinks

A sink copies your sessions to another place: an OpenTelemetry collector (otlp) or any HTTP endpoint that takes coding.sh's JSON (http). Sinks send metadata unless you set mode = "full":

# ~/.coding.sh/config.toml
[[sinks]]
kind = "otlp"                      # or "http"
endpoint = "http://localhost:4318"
mode = "metadata"                  # the default; "full" sends content, redacted first
headers = { Authorization = "Bearer ${OTEL_TOKEN}" }

coding.sh init --remote writes an http sink named team for you: see Self-host for a team.

The model API proxy

The proxy stores each call's request and response, redacted with the same rules. It keeps an allowlist of headers (API version, beta flags, user agent, session and request ids, rate limits) and never stores Authorization, x-api-key or cookies. In metadata mode it keeps hashes of the system prompt and tools, counts, tool names, usage and timing. It listens on 127.0.0.1 unless you pass --host.

The raw spool

The hook writes what the agent sends to ~/.coding.sh/spool (mode 600) without redacting it, to stay fast. Ingest then stores a redacted copy.

• Both hooks give a payload its own file under spool/<agent>/raw/, unless its spool line fits in about 1 KB. Once ingested, that file is rewritten with secrets redacted, in every capture mode.
• A short payload inside the day's spool file stays as written until its UTC day has passed and ingest has read the whole file. Then ingest redacts it in place. The line keeps its length, so ingest cursors still hold.
• With CODING_SH_DISABLE=1 the hooks write no payload, only the session id, to spool/disabled-sessions, so ingest and ingest --backfill leave that session out.
• coding.sh gc deletes ingested spool files older than 7 days ([retention] keepSpoolDays), never the current day's. coding.sh purge removes a value sooner.

Remove a leaked secret

When a value got past redaction, put it in a file, one value per line, and purge it. Count the copies first:

coding.sh purge --literal leaked.txt --dry-run
coding.sh purge --literal leaked.txt

--literal - reads the values from stdin. To remove every value of one shape, pass a regular expression; write the shape, not the secret, because it sits on the command line:

coding.sh purge --rule 'sk-ant-api03-[A-Za-z0-9_-]{80,}' --dry-run

Every copy becomes [redacted:purged]:

Values shorter than 8 characters are refused, and neither values nor matches are printed. Purge works on the SQLite store only. Rotate the secret as well: the agent's own transcripts, your shell history and git are not touched.

Next steps

• Self-host for a team: what a team server receives in each mode.
• Configuration: every [capture], [retention] and [[sinks]] key.
• Postgres and ClickHouse stores: where a team server keeps the data.