Faq

Will this rotate my keys? No. It reports and can redact local transcripts. You still rotate at the provider.

Can I take a scrub back? Yes: spillscan undo previews it and spillscan undo --write puts the .bak originals back, keeping any lines the agent wrote after the scrub. A file edited in any other way is left alone.

Does MCP redact? No. MCP exposes read-only scan_report and list_paths.

False positives? Generic KEY= assignments already require high entropy. For the rest, copy the finding's FP from scan output into ~/.config/spillscan/allow.txt as fp:<FP>; you can also allowlist a rule under a path glob. See Configuration. If a detector is wrong for everyone, open an issue with a fake fixture.

Does the fingerprint leak the secret? It is the first 12 hex characters of a SHA-256 over the value. Detectors only fire on long, high-entropy strings, so it cannot be reversed or guessed in practice, and it is safe to paste into an allowlist or an issue.

vs Stroq? Stroq is a firewall over known local values; spillscan is the cleanup meter for pattern-matched spills already on disk.