Secret redaction, explained
While Streaming Mode is on, Mastery HQ masks secret-shaped text at the moment it renders — an echoed API key shows as sk-a…••••, a cat .env shows variable names with hidden values — across the terminal, agent transcripts, and the audit log. It’s render-time only: your data is never modified, and leaving Streaming Mode restores every character instantly.
What’s covered
Section titled “What’s covered”- Recognized key formats:
sk-…(OpenAI/Anthropic/OpenRouter),xai-…, GitHub (ghp_,github_pat_…), AWS (AKIA…), Slack (xox…), Google (AIza…), npm, JWTs (eyJ…), andBearertokens. - Env-style dumps: any
SOMETHING_KEY= / _TOKEN= / _SECRET= / _PASSWORD=line gets its value masked —printenv,set,.envcontents. - Unknown formats: long, random-looking mixed-case strings are masked by a fallback pattern (git commit hashes deliberately survive — they’re lowercase hex).
- Surfaces beyond text: the license account e-mail is masked and minted codes hidden; Open .env file is disabled; the Spotify connect-diagnostics row is hidden; copying a secret-shaped selection warns you.
What’s NOT covered — and the answer to it
Section titled “What’s NOT covered — and the answer to it”Web pages in the Browser pane render arbitrary content that text-masking can’t reach. That’s the job of the privacy scene: with OBS/Streamlabs connected, Mastery HQ jumps your stream to a safe scene whenever a sensitive pane opens (details). Belt and suspenders.
Why there’s no off switch
Section titled “Why there’s no off switch”Redaction is integral to Streaming Mode rather than a separate toggle for one reason: a safety layer you can forget to enable is a safety layer that fails exactly once. If you need the full text, leave Streaming Mode — the two states are one click apart.
Frequently asked questions
What exactly gets masked while streaming?
Key-shaped strings wherever they'd render: OpenAI/Anthropic-style sk- keys, xAI, GitHub, AWS, Slack, Google and npm tokens, JWTs, Bearer tokens, and KEY=value lines from .env dumps — in terminal output, agent transcripts, and the audit log. Plus: license account masked, minted codes hidden, the .env reveal button disabled.
Why did it mask something that wasn't a secret?
Redaction is deliberately aggressive while live: any long random-looking mixed-case string can match the generic pattern. A masked non-secret costs a moment; a leaked real key can cost an account. Toggle Streaming Mode off to read the original — nothing was changed underneath.