Synthèse
Command lines often contain secrets. curl and wget make this worse because headers, tokens, signed URLs, basic-auth credentials, and proxy usernames can all appear in process arguments. The rules redact known secret patterns before aggregation and before COMPLETION runs. This includes authorization headers, bearer tokens, API keys, query string secrets, URL embedded credentials, user/password flags, and JSON Web Tokens (JWTs). | EVAL Esql.command_clean = Esql.full_command_line | EVAL Esql.comman
Command lines often contain secrets. curl and wget make this worse because headers, tokens, signed URLs, basic-auth credentials, and proxy usernames can all appear in process arguments. The rules redact known secret patterns before aggregation and before COMPLETION runs. This includes authorization headers, bearer tokens, API keys, query string secrets, URL embedded credentials, user/password flags, and JSON Web Tokens (JWTs). | EVAL Esql.
command_clean = Esql. full_command_line | EVAL Esql. command_clean = REPLACE(Esql. command_clean, """(? i)(authorization: *[a-z]+ +)[^'" ]+""", "$1 ") | EVAL Esql.
command_clean = REPLACE(Esql. command_clean, "(? i)(authorization: *)[a-z0-9. _~+/=-]{8,}", "$1 ") | EVAL Esql. command_clean = REPLACE(Esql.
command_clean, """(? i)(bearer +)[^'" ]+""", "$1 ") | EVAL Esql. command_clean = REPLACE(Esql. command_clean, """(? i)((x-api-key|api-key|apikey|private-token|x-auth-token|x-aws-ec2-metadata-token|x-amz-security-token|x-amz-signature|x-amz-credential) *[:=] *)[^'" ]+""", "$1 ") | EVAL Esql.
command_clean = REPLACE(Esql. command_clean, """(? i)([? &][a-z0-9_. -]*(?
:token|key|secret|signature|credential|password|passwd|sig|sas|auth|session|access)[a-z0-9_. -]*=)[^&'" ]+""", "$1 ") | EVAL Esql. command_clean = REPLACE(Esql. command_clean, "(? i)(://)[^/@ ]+@", "$1 @") | EVAL Esql.
command_clean = REPLACE(Esql. command_clean, """(? i)(--(http-|proxy-)? (user|password)[ =]|-u +)[^'" ]+""", "$1 ") | EVAL Esql. command_clean = REPLACE(Esql.
command_clean, "eyJ[A-Za-z0-9_-]+[. ][A-Za-z0-9_-]+[. ][A-Za-z0-9_-]+", " ") Warning: These patterns cover common secret formats but not all of them. Treat them as a starting point, and review what actually reaches the model. Command text leaves your environment when COMPLETION calls the inference endpoint, so keep that endpoint within your trust boundary and redact before, not after, the model sees the row.
Redaction protects sensitive data.