safe-session-redaction

name	safe-session-redaction
description	Scan public-bound files and session material for secrets, local paths, emails, raw logs, screenshots, private prompts, .env data, and other leak patterns before publishing.

Safe Session Redaction

Use this skill before publishing a repo, blog post, screenshot, example, release archive, or session summary.

Scan Targets

Check public-bound files for:

• local absolute paths;
• emails, usernames, and personal data;
• API keys, tokens, passwords, private keys, and .env values;
• raw OpenCode session exports, JSONL event streams, and raw logs;
• private prompts or prompt history;
• screenshots and browser artifacts;
• private repo URLs, branch names, issue titles, customer names, or roadmap details.

Required Commands

Run:

python3 scripts/validate_public_pack.py .

For session material, run:

python3 scripts/redact_sessions.py agent-sessions/<project-slug>/<prompt-id>

To produce redacted copies:

python3 scripts/redact_sessions.py agent-sessions/<project-slug>/<prompt-id> --out tmp-redacted-session

Manual Review

Automated redaction is not enough. Manually inspect:

• markdown files;
• script snippets;
• sample environment files;
• generated output;
• screenshots and browser captures;
• git remotes and URLs;
• logs copied into docs.

Do not publish if suspicious material remains.