name: Secret Scrubber
repo: https://github.com/sureshr-dev/opencode-secret-redactor
tagline: Scrub secrets from the outbound LLM prompt before it reaches the provider
description: Redacts secrets from the whole outbound prompt (system, messages, tool calls, and tool results) at the V2 session hooks, so the model and provider never see them. Two detection layers - known-value matching from environment variables and an optional secrets file, plus a vendored high-signal Gitleaks pattern set. Includes local logging and sub-millisecond overhead per call.
kind: plugin
topics:
  - security
compat: v2