Guides

What stays local, what is excluded, and how the secret scanner works.

• Local-first. Notes are plain files in your repository. ContextBridge makes no network calls.
• Excluded files. Files matching .env, .env.*, *.pem, *.key, *.p12, *.pfx, id_rsa*, id_ed25519*, secrets.* and credentials*.json are never recorded; add your own patterns in .contextbridgeignore. The checkpoint reports how many files were excluded.
• Reviewed writes. Every change to your notes is shown as a diff before it is written.
• Secret scanner. Content is scanned before it is written, exported or captured from a test run. It refuses by default; --redact replaces matches instead.
• Concurrent writes. Commands that write take a lock in the git directory, so parallel writers do not clobber each other.

What the scanner recognises

Private key blocks, and keys or tokens for AWS, GitHub, GitLab, Slack, Google, Stripe, SendGrid, npm, PyPI, Hugging Face, DigitalOcean, Shopify, Mailchimp, Telegram, Twilio, Azure, sk- style API keys, JWTs, passwords inside URLs, and generic secret = "..." style assignments.

contextbridge scan notes.md config.txt   # exit 2 if anything is found