Credential masking
Redact secrets from terminal output before it reaches the viewer.
porthole host --maskWith --mask, output is rewritten before it leaves your machine. Your own
terminal is unchanged; only what the viewer receives is redacted.
You see: export GITHUB_TOKEN=ghp_16C7e42F292c6912E7710c838347Ae178B4a
Viewer sees: export GITHUB_TOKEN=[redacted:github_token]What it recognises
Out of the box: AWS keys, GitHub and GitLab tokens, OpenAI and Anthropic keys, Stripe, Slack, Google, SendGrid and npm tokens, JWTs, private-key headers, passwords inside connection strings, and high-entropy values assigned to secret-sounding names.
Adding your own patterns
porthole host --mask-pattern 'ACME-[0-9]{8}'--mask-pattern implies --mask, and is repeatable. To run only your
patterns and switch the built-in rules off:
porthole host --mask --mask-pattern 'ACME-[0-9]{8}' --mask-no-autoRedaction happens before buffering
Output is redacted at the point it is produced, not at the point it is sent. That matters for reconnection: the replay buffer a viewer receives when they rejoin holds already-masked text, so a credential cannot reappear when someone comes back.
The session summary
When the session ends, Porthole prints what it redacted and how often:
🔒 4 secrets masked from the viewer this session
github_token ×2, aws_access_key ×1, jwt ×1This is worth reading. If it says zero and you expected otherwise, the rules did not match what you thought they would.
Best-effort, by construction
Masking is defence in depth, not a guarantee. It catches routine accidents —
cat .env, an echoed token, a stack trace containing a connection string —
but it cannot stop a determined attempt to exfiltrate a secret, it cannot see
values assembled only on the rendered screen, and it will miss credentials
with no recognisable shape.
Treat it as lowering the cost of a mistake, not as a reason to share a terminal you otherwise would not.
Related
porthole probe masks its report by default for the same reason — a
diagnostics file is meant to be pasted into an issue tracker. See
Diagnostics.