Keep secrets out of the output

Goal: make sure a fusion you hand to an agent or paste into a chat does not carry an AWS key, a connection string, or a token.

It is on by default

Redaction runs automatically during reduction, before token counting. Fuse scans content for known secret shapes and high-entropy literals and replaces each match in place:

var connection = "[REDACTED:ConnectionString]";

The surrounding code keeps its shape, only the secret value is replaced, and the reported token count reflects the redacted output. You do not need a flag to get this.

Confirm what was removed

fuse dotnet --directory ./src --redact-report

--redact-report appends a summary stating how many secrets of each kind were redacted, useful for auditing before you share.

Turn it off (rarely)

fuse dotnet --directory ./src --no-redact

--no-redact writes content exactly as read. Use it only when you are certain the source contains no live secrets, and never on output intended for sharing, pasting, or committing.

What it detects

AWS access and secret keys, JSON Web Tokens, PEM private keys, connection strings, API tokens, and high-entropy string literals. Detection is best-effort, using pattern and entropy heuristics rather than a definitive parse: it can flag a non-secret value and it can miss a secret in an unusual shape. Treat it as a strong default that lowers exposure, not a guarantee, and review output before sharing where a leak would be costly.

When to use it

Always, by default, whenever a fusion leaves your machine. The only decision is whether to add --redact-report for an audit trail or, in a closed loop with no live secrets, --no-redact.

Related concept

The exact match rule for each kind is in the Secret redaction kinds reference.