@normful/pi-stop-secrets-leaks
Pi extension that helps prevent secrets from leaking
Package details
Install @normful/pi-stop-secrets-leaks from npm and Pi will load the resources declared by the package manifest.
$ pi install npm:@normful/pi-stop-secrets-leaks- Package
@normful/pi-stop-secrets-leaks- Version
0.3.0- Published
- Oct 1, 2026
- Downloads
- 249/mo · 10/wk
- Author
- normful
- License
- MIT
- Types
- extension
- Size
- 32.9 KB
- Dependencies
- 0 dependencies · 4 peers
Pi manifest JSON
{
"video": "https://github.com/normful/pi-bakery/raw/refs/heads/main/videos/stop-secrets-leaks-demo.mp4",
"extensions": [
"./src/index.ts"
]
}Security note
Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.
README
@normful/pi-stop-secrets-leaks
Pi extension that detects secrets using betterleaks and redacts them by position before they reach the LLM.
- Project files — scanned at session start via
betterleaks dir - Environment variables — scanned at session start via
betterleaks stdin - Tool result text — scanned reactively on each tool call
Secret values are never stored or logged. All betterleaks invocations use
--redact=100; only metadata (positions, rule IDs, fingerprints) is kept.
Redacted spans are replaced with opaque «🔒 $S_NN» placeholders.
Installation
Install betterleaks. Then:
pi install npm:@normful/pi-stop-secrets-leaksCommands
| Command | Description |
|---|---|
/stop-secrets-leaks-status |
Show extension status and finding counts |
/stop-secrets-leaks-toggle |
Enable or disable redaction |
/stop-secrets-leaks-rescan |
Re-scan project and environment |
/stop-secrets-leaks-config |
Set the betterleaks scan timeout |
Warning
This isn't a 100% guaranteed way of preventing all secrets from leaking to the LLM. Stack this with other countermeasures and secrets management tools to further reduce likelihood of leaked secrets.
Inspiration
This extension is inspired by these similar Pi extensions: