Captured transcripts are sent unredacted — pasted secrets leave the machine verbatim

[serge-it-max]

Summary

The Stop hook sends captured transcript text to the memory API with no secret redaction at all. Anything typed into the conversation — an API key pasted while debugging, a connection string, a token from a log — leaves the machine verbatim and is stored as a memory document.

There is no setting to redact or exclude patterns, and no redaction code anywhere in plugin/ (grep -rin "redact" plugin/ returns nothing). Plugin version 0.1.6.

Repro

Point the plugin at a local server instead of the API and run the capture hook directly:

git clone --depth 1 https://github.com/supermemoryai/claude-supermemory
cd claude-supermemory

cat > /tmp/transcript.jsonl <<'JSONL'
{"type":"user","uuid":"u1","message":{"role":"user","content":"deploy is broken. i used OPENAI_API_KEY=sk-proj-FAKEKEYFORREPRO0000000000000000 and DATABASE_URL=postgres://admin:FAKEPASSWORD@10.0.0.5:5432/prod — what is wrong?"}}
{"type":"assistant","uuid":"a1","message":{"role":"assistant","content":[{"type":"text","text":"Rotate that key immediately, then check the host."}]}}
JSONL

# minimal sink that prints what it receives on :8787
node -e 'require("http").createServer((q,s)=>{let b="";q.on("data",c=>b+=c);q.on("end",()=>{console.log(q.method,q.url);console.log(b);s.end("{\"id\":\"doc_fake\"}")})}).listen(8787,"127.0.0.1")' &

echo '{"session_id":"repro-1","transcript_path":"/tmp/transcript.jsonl","cwd":"'"$PWD"'"}' \
  | SUPERMEMORY_CC_API_KEY=sm_fake \
    SUPERMEMORY_API_URL=http://127.0.0.1:8787 \
    node plugin/hooks/capture.js

Received body (POST /v3/documents), unmodified:

{
  "content": "<|turn_start|>2026-09-09T17:34:26.994Z\n\n<|start|>user<|message|>deploy is broken. i used OPENAI_API_KEY=sk-proj-FAKEKEYFORREPRO0000000000000000 and DATABASE_URL=postgres://admin:FAKEPASSWORD@10.0.0.5:5432/prod — what is wrong?<|end|>\n\n<|start|>assistant<|message|>Rotate that key immediately, then check the host.<|end|>\n\n<|turn_end|>",
  "containerTag": "repo_claude_supermemory__6b8d7c204683aa6a",
  "metadata": { "type": "session_turn", "sm_capture_mode": "automatic", "...": "..." }
}

Both the fake key and the fake password arrive intact.

Where this happens

• plugin/hooks/lib/settings.js:7 — BASE_URL = 'https://api.supermemory.ai' is the default sink.
• plugin/hooks/capture.js:50-72 — builds the delta and posts it on every Stop.
• plugin/hooks/lib/transcript.js:98-107 — user text goes through cleanContent() only, and is not truncated.
• plugin/hooks/lib/transcript.js:183-190 — cleanContent() strips <system-reminder> and <supermemory-context> blocks. That is the entire sanitisation step.
• Tool payloads are length-limited but not filtered: transcript.js:177 (tool input, 100 chars per field) and transcript.js:10/115-118 (tool result, 500 chars).

Defaults make this the common path rather than an edge case: signalExtraction defaults to false (settings.js:17), so formatNewEntries captures every user and assistant turn, not just signal turns.

Why it is worth fixing even if the backend is trusted

This is not only about what crosses the network. A captured secret becomes a memory document, gets fact-extracted, and can then be re-injected into later sessions through recall and profile context — including sessions in a different repository, since the container is per-repo but the profile is not. A key pasted once during debugging can resurface in an unrelated conversation weeks later. Client-side redaction keeps it out of the store in the first place, where deleting it afterwards is far harder.

The README's Privacy section currently just links to the privacy policy; nothing tells the user that raw prompt text is captured verbatim by default.

Suggested minimal fix

1. Add a redaction pass inside cleanContent() (or a new redact() called from it) covering the common shapes: sk-/sk-proj-/ghp_/gho_/github_pat_, AWS AKIA…, Bearer <token>, xox[baprs]-, JWTs, and URLs carrying user:password@. Replace with [REDACTED] rather than dropping the message, so the memory stays useful.
2. Make it configurable in ~/.supermemory-claude/settings.json: redactPatterns (extra regexes) and redactionEnabled (default true), matching the existing settings style.
3. Document the behaviour in the README's Privacy section — one line stating what is captured and how to extend the pattern list.

Happy to send a PR for 1 and 2 if the approach looks right to you.

[SanLuis-AI-Solutions]

Independent confirmation on the current release, plus a working fix.

Status on 0.1.8 (current latest.json)

Still unredacted. plugin/hooks/lib/api.js at HEAD:

function addMemory(baseUrl, apiKey, content, containerTag, metadata, options = {}) {
  const body = {
    content,
    containerTag,
    metadata: { sm_source: 'claude-code', ...metadata },
  };
  ...
  return post(baseUrl, apiKey, '/v3/documents', body, options.timeoutMs);
}

grep -i redact over the file returns nothing. The reported behavior reproduces on the version users are installing today, not just 0.1.6.

Field evidence

I hit this in production. A Stop-hook capture persisted a live credential-shaped value from a transcript into the memory store, where it was retrievable by every connected agent through /v3/documents/{id} and injected into agent context. Stored document content ran to ~100 KB, so a single capture carries a great deal of transcript text through this path.

The pattern matched was an export NAME=value assignment for a known credential name — exactly the shape in the repro, and the reason the fix below keys on credential-shaped input rather than a bare keyword list.

Suggested fix

One change at the write boundary, in addMemory, before the body is built. capture.js and every other caller inherit it for free.

const SECRET_PATTERNS = [
  [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/gi, '[REDACTED:private_key_block]'],
  [/\b(?:SUPERMEMORY_(?:API_KEY|CODEX_API_KEY|CC_API_KEY)|GITHUB_(?:TOKEN|PAT)|SLACK_(?:BOT|APP)_TOKEN|OPENAI_API_KEY|ANTHROPIC_API_KEY|AWS_(?:SECRET_ACCESS_KEY|ACCESS_KEY_ID))\s*[:=]\s*[^\s,;]+/gi, '[REDACTED:env_secret_assignment]'],
  [/(?<![A-Za-z0-9])sm_[A-Za-z0-9_-]{20,}/g, '[REDACTED:supermemory_key]'],
  [/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|xapp-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9_-]{20,}|(?:AKIA|ASIA)[0-9A-Z]{16})\b/g, '[REDACTED:provider_token]'],
  [/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi, 'Bearer [REDACTED:bearer_token]'],
];

function redactSecrets(text) {
  if (typeof text !== 'string' || text.length === 0) return text;
  let out = text;
  for (const [rx, replacement] of SECRET_PATTERNS) out = out.replace(rx, replacement);
  return out;
}

function addMemory(baseUrl, apiKey, content, containerTag, metadata, options = {}) {
  content = redactSecrets(content);   // <-- the fix
  const body = { content, containerTag, metadata: { sm_source: 'claude-code', ...metadata } };
  ...
}

Design notes, in case they are useful:

• Deterministic, not model-based. A regex pass is cheap, synchronous, offline, and returns the same answer every time. Filtering security-sensitive data should not depend on a model call that can fail, cost tokens, or be reasoned around.
• Every pattern requires credential-shaped input — a known prefix plus a length floor, or an explicit assignment to a known credential name. Ordinary prose is not touched, so recall quality is unaffected.
• Redact rather than block. The surrounding conversation is the valuable memory; the credential is the part that must not persist. Dropping the whole capture would lose real context.
• Redaction happens before the body is built, not on the response path, so the value never reaches the network layer.

Test that ships with it

Positive cases (must all become [REDACTED]): the repro's shapes, plus sm_, ghp_, github_pat_, xoxb-, sk-, AKIA, PEM blocks, and Bearer headers.

Negative cases (must be untouched):

The API returns a JSON envelope with success and data fields.
We call addMemory() from capture.js on the Stop hook.
set DEBUG=true before running
Never commit sk- prefixed keys to the repository.

Note for anyone patching locally

~/.claude/plugins/cache/... is replaced wholesale on claude plugin update, so a hand-patch to api.js is silently lost on the next update. If you patch locally in the meantime, keep the guard source outside the cache and re-apply it after updates — otherwise the exposure quietly returns.

Thanks for the clear repro in the original report; it made this straightforward to confirm end to end.