Redacted twice

Credentials are scrubbed on your machine before anything leaves it, and scrubbed again on arrival. Two passes because the client is code we do not control once it is installed — an old shim, a custom integration or a curl one-liner will send raw text.

What is matched

Bearer tokens, GitHub / Anthropic / OpenAI / AWS / Slack credentials, JWTs, connection-string passwords, SECRET=-style shell assignments, PEM private key blocks, and Poggle's own relay keys. Object keys that look sensitive are blanked regardless of what the value looks like.

Append-only at the database

There is no insert or update policy on the event log for signed-in users. Events arrive through a service role and no interface can rewrite them. A leaked relay key can add noise to your history; it cannot change or delete it.

Scoped credentials

A relay key reaches one workspace's session log and nothing else. Keys are stored as a prefix and a SHA-256 hash — there is no code path that can recover the secret, which is why losing one means rotating rather than looking it up.

Tenant isolation

Every read is row-level-security scoped to workspace membership. A session id from another workspace returns the same not-found as one that does not exist, so a probe learns nothing.

Paths, not people

Home directories are stripped from file paths at capture time. An absolute path leaks a username and a machine layout; a relative one does not.

Bounded by construction

Payloads are capped, redaction is depth- and length-limited so hostile input terminates, and oversized tool output is replaced with a marker rather than stored.

Found a problem? Open an issue, or write to us — we would rather hear about it early than read about it later.