Response Body Redaction & Echo Defense

When an AI agent makes an API call through the Credential Proxy, the agent only specifies a key name reference (e.g. STRIPE_KEY). The proxy injects the real cryptographic value at the network transport layer, ensuring the agent never has the secret in memory.

However, an insidious vulnerability exists at the HTTP layer: Credential Echo Exfiltration.

Many third-party APIs inadvertently echo authorization credentials back in HTTP response bodies or error payloads:

• Stripe Error Payloads: If a request fails with an invalid key, Stripe may echo the key back in the error message: "Invalid API Key provided: sk_live_51..." or partially masked: "RESTRICT*DDUH".
• OAuth & Redirect Handlers: Identity providers often echo the Bearer token or authorization code in redirect parameters or URL-encoded response fields.
• OpenAI & Anthropic SDKs: Verbose error messages often include debugging fragments containing client-side credentials.

If this response reaches the AI agent, the secret is immediately placed into the LLM's context window, completely bypassing your zero-exposure architecture.

To defeat this attack vector, the AgentSecrets Credential Proxy executes an inline Real-Time Response Body Scanner & Redaction Engine.

How Response Redaction Works

Every HTTP response received from an upstream service passes through redactSecretFromResponse in the proxy engine before being delivered to the calling client:

Loading diagram...

Under the Hood: The 4-Stage Candidate Pattern Matcher

A naive exact-string match (bytes.ReplaceAll) fails in production because APIs frequently alter, escape, or mask credentials before echoing them.

The Go proxy engine (pkg/proxy/engine.go) executes a 4-stage replacement pipeline:

1Exact Plaintext Substitution

body = bytes.ReplaceAll(body, []byte(secretValue), []byte(redactionPlaceholder))

2URL-Percent Escaped Matching

urlEncoded := url.QueryEscape(secretValue)
if urlEncoded != secretValue {
    body = bytes.ReplaceAll(body, []byte(urlEncoded), []byte(redactionPlaceholder))
}

3JSON String Escaping

jsonEscaped := strings.ReplaceAll(secretValue, `"`, `"`)
if jsonEscaped != secretValue {
    body = bytes.ReplaceAll(body, []byte(jsonEscaped), []byte(redactionPlaceholder))
}

4Masked Prefix Regex Matching (Echo Obfuscation)

escapedPrefix := regexp.QuoteMeta(secretValue[:prefixLen])
pattern := escapedPrefix + `[\*\.\-_#]{1,4}[^\s"'\,}\]]{0,30}`

Wire-Level HTTP Transformations

When response redaction alters the payload, the proxy automatically updates the HTTP transport framing:

1. Content-Length Recalculation: Because [REDACTED_BY_AGENTSECRETS] may have a different byte length than the original secret, the proxy recalculates and updates the Content-Length header to prevent connection stalls or truncated payloads.
2. Chunked Transfer Encoding: If the upstream response uses chunked transfer encoding (Transfer-Encoding: chunked), the proxy buffers the chunks, executes the redaction pass, and re-encodes the chunks cleanly for the client.
3. Audit Notification Header: The proxy injects an audit header into the HTTP response delivered to the client:

   X-AS-Redacted: true

   This allows client libraries, SDKs, and observability middleware to detect that an echo occurred without reading the body.

Audit Trail & Event Telemetry

Every redaction event is recorded as a high-severity security alert in the AgentSecrets local audit trail:

• Event Type: credential_echo
• Logged Fields: Timestamp, target domain (api.stripe.com), HTTP method (GET/POST), response status code (400), and the secret key name (STRIPE_KEY).
• Zero Plaintext Principle: The echoed value itself is never written to the audit log. Only the fact that an echo occurred and the target endpoint are recorded.

Viewing Echo Events in the CLI

agentsecrets proxy logs --last 10

Output:

14:23:01  POST  api.stripe.com/v1/charges  STRIPE_KEY  400  credential_echo  184ms