> ## Documentation Index
> Fetch the complete documentation index at: https://praison.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Security & Redaction
> Privacy hardening for context snapshots and monitoring
```mermaid theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
graph LR
subgraph "Security & Redaction"
Request[📋 User Request] --> Process[⚙️ Security & Redaction]
Process --> Result[✅ Result]
end
classDef input fill:#6366F1,stroke:#7C90A0,color:#fff
classDef process fill:#189AB4,stroke:#7C90A0,color:#fff
classDef output fill:#10B981,stroke:#7C90A0,color:#fff
class Request input
class Process process
class Result output
```
```mermaid theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
sequenceDiagram
participant User
participant Agent
participant Feature as Security & Redaction
User->>Agent: Request
Agent->>Feature: Process request
Feature-->>Agent: Result
Agent-->>User: Response
```
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents import Agent
agent = Agent(
name="secure-agent",
instructions="Redact sensitive data from context before processing.",
)
agent.start("Process this document and redact all PII.")
```
Context security features protect sensitive data in snapshots and validate output paths.
The user sends messages containing secrets; redaction strips sensitive fields before context reaches the LLM.
```mermaid theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
graph LR
subgraph "Security & Redaction"
In[📝 Raw Input] --> Redact[🛡️ Redact PII]
Redact --> Agent[🤖 Agent]
Agent --> Out[✅ Safe Snapshot]
end
classDef input fill:#6366F1,stroke:#7C90A0,color:#fff
classDef process fill:#F59E0B,stroke:#7C90A0,color:#fff
classDef agent fill:#8B0000,stroke:#7C90A0,color:#fff
classDef output fill:#10B981,stroke:#7C90A0,color:#fff
class In input
class Redact process
class Agent agent
class Out output
```
## How It Works
```mermaid theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
sequenceDiagram
participant User
participant Agent
participant Redactor
participant LLM
User->>Agent: Message with secrets
Agent->>Redactor: redact_sensitive=True
Redactor-->>LLM: Sanitised context
LLM-->>User: Response without leaked PII
```
## Quick Start
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents import ContextManager, ManagerConfig
config = ManagerConfig(
redact_sensitive=True,
allow_absolute_paths=False,
monitor_path="./context.txt",
)
manager = ContextManager(config=config)
```
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents.context import redact_sensitive
safe = redact_sensitive("My API key is sk-abc123def456ghi789")
# "My API key is [REDACTED]"
```
## Redaction Patterns
Automatically redacted:
| Pattern | Example |
| --------------- | ------------------ |
| OpenAI keys | `sk-abc123...` |
| Anthropic keys | `sk-ant-...` |
| Google API keys | `AIzaSy...` |
| Google OAuth | `ya29....` |
| AWS access keys | `AKIA...` |
| Bearer tokens | `Bearer ...` |
| Passwords | `password = "..."` |
| API keys | `api_key: "..."` |
## Using Redaction
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents.context import redact_sensitive
text = "My API key is sk-abc123def456ghi789"
safe = redact_sensitive(text)
# "My API key is [REDACTED]"
```
## Path Validation
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents import validate_monitor_path
# Valid paths
is_valid, error = validate_monitor_path("./context.txt")
# (True, "")
# Path traversal blocked
is_valid, error = validate_monitor_path("../../../etc/passwd")
# (False, "Path traversal (..) not allowed")
# Absolute paths blocked by default
is_valid, error = validate_monitor_path("/tmp/context.txt")
# (False, "Absolute paths not allowed...")
# Allow absolute explicitly
is_valid, error = validate_monitor_path(
"/tmp/context.txt",
allow_absolute=True,
)
# (True, "")
```
## Ignore/Include Patterns
Respect `.praisonignore` and `.praisoninclude` files:
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents import (
should_include_content,
load_ignore_patterns,
)
# Load patterns from files
ignore, include = load_ignore_patterns(".")
# Check if file should be included
if should_include_content("secret.key", ignore, include):
# Include in snapshot
pass
```
### .praisonignore
```
# Ignore patterns (glob)
*.key
*.pem
*.env
secrets/
node_modules/
```
### .praisoninclude
```
# Include patterns (whitelist)
*.py
*.js
*.md
```
## Configuration
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
config = ManagerConfig(
redact_sensitive=True, # Enable redaction
allow_absolute_paths=False, # Block absolute paths
monitor_path="./context.txt",
)
```
### Environment Variables
```bash theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
export PRAISONAI_CONTEXT_REDACT=true
```
## Redaction in Snapshots
All snapshot outputs are redacted:
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
# Human format
# API key: [REDACTED]
# JSON format
# {"content": "API key: [REDACTED]"}
```
## Adding Custom Patterns
```python theme={"theme":{"light":"vitesse-light","dark":"vitesse-dark"}}
from praisonaiagents.context.monitor import SENSITIVE_PATTERNS
# Add custom pattern
SENSITIVE_PATTERNS.append(r'my-custom-token-[a-z0-9]+')
```
## Best Practices
Default redaction is on for a reason — do not disable it in shared or production environments.
Absolute paths can leak usernames and directory layout to logs or support tickets.
Exclude secrets, credentials, and env files from context indexing and snapshots.
If a snapshot ever captured a live secret, rotate the credential immediately — redaction is not retroactive.
## Related
Snapshot output and formats
Restrict file access in agents