Overlane scans every write to the API (pushes, task records, evidence and rule files), memory candidates and review diffs for credentials, on the server. You can also scan a log file yourself with --source log; automatic log scanning arrives with observability.
- A provider-prefixed key (GitHub, Stripe, AWS, Slack, Google, npm, private key blocks, JSON web tokens and Overlane tokens), and a vendor token such as an Anthropic or OpenAI key, blocks. Nothing is stored or pushed.
- A generic high-entropy string is reported, not blocked, as GitHub push protection does.
A finding names the rule, the source and the line. It never contains the matched text, so it is safe to log and to return.
overlane guard scan --path src/config.ts
overlane guard scan --path ci.log --source logThe command exits 6 when something would block. A blocked push comes back as a refusal with the code secret_detected; remove the key, rotate it, and push again.
In a review, a credential in the diff is replaced before anything is sent to a model and is raised as a critical finding.