> ## Documentation Index
> Fetch the complete documentation index at: https://qodex.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Prevent secrets in scenarios and findings

> Keep credentials out of saved content by using variables, encrypted auth profiles, and evidence redaction.

# How do I keep secrets from leaking into scenarios and findings?

Do not put secrets directly in scenarios, chats, findings, memory, or docs.

Store credentials in environments and auth profiles, then reference them with variables. Qodex substitutes the real values only when a test runs.

## Use variables in scenarios

Use variables such as `${API_BASE_URL}`, `${AUTH_TOKEN}`, `${AUTH_EMAIL}`, and `${AUTH_PASSWORD}` instead of literal credentials.

```json theme={null}
{
  "method": "POST",
  "target": "${API_BASE_URL}/login",
  "body": {
    "email": "${AUTH_EMAIL}",
    "password": "${AUTH_PASSWORD}"
  }
}
```

The saved scenario stays portable and does not contain the secret value.

## Store credentials in the right place

Use:

* Environments, under **Context** in the left navigation, for base URLs and target-specific values.
* Auth profiles for login credentials, tokens, and OAuth details.
* **Settings > LLM keys** for provider API keys.
* **Settings > Connections** for connector tokens. Connector credentials are write-only and never shown again after you save them.

Sensitive values are encrypted at rest before persistence. In the UI, saved secrets should appear masked instead of plaintext.

## Redaction is a safety net

Qodex redacts common secret shapes from captured evidence, including bearer tokens, JWT-like strings, GitHub tokens, AWS-style keys, and high-entropy values.

Redaction helps when a response accidentally echoes a secret. It should not be your first line of defense.

When the agent reads code from a linked repository, secrets are redacted from everything it reads.

## Avoid secrets in these places

* Scenario JSON.
* Finding titles or descriptions.
* Chat messages.
* Autopilot task comments.
* Knowledge files, including documents you upload.
* Documentation examples.
* PR comments.

## Self-hosted note

In self-hosted deployments, encrypted credentials depend on `QODECLAW_SECRET_KEY`.

If you lose that key, encrypted secrets cannot be recovered and must be re-entered.

## Next steps

> [card] [Secret management](https://qodex.ai/docs/self-hosted-secret-management.md)
>
> Understand encryption at rest.

> [card] [Auth profiles](https://qodex.ai/docs/api-testing-auth-profiles.md)
>
> Store reusable login credentials.

> [card] [Environment variables](https://qodex.ai/docs/self-hosted-environment-variables.md)
>
> Configure self-hosted secrets safely.

> [card] [Sensitive endpoints](https://qodex.ai/docs/security-testing-sensitive-endpoints.md)
>
> Handle risky routes carefully.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.