OpenTree DashboardSign in

$ date -I # 2026-07-24

How agent output leaks secrets, and what a publish path can catch

The disclosure risk with agent output is not that the model is malicious. It is that the page is built from whatever was in context, and context accumulates things that should never end up on the open web. Two design choices decide whether that becomes an incident.

Where the leak comes from

Not the model deciding to reveal something. The page is stitched from what was in the window — a database result, a customer list, and now and then the credential that fetched them. A page that looks like a clean report can carry a bearer token in an inlined script or a comment the author never read.

Why public-by-default makes it worse

Public-by-default assumes the author reviewed every byte for disclosure. An agent breaks that assumption — it produces faster than anyone audits. So the safe posture is unlisted first: an unguessable token, no-referrer, noindex, and no crawler invited.

The scan before storage

Before the bytes are written, they are scanned for the shapes of secrets and personal data; a hit blocks the publish unless you deliberately override. It runs on your own deployment, in the publish path, so nothing is sent anywhere to be checked. It is a backstop, not a guarantee — but it catches the most common leak, which is a credential riding along in the context.

What the URL itself gives away

Almost nothing, by design. The token is 22 characters from a 62-character alphabet — on the order of 1039 possibilities — so guessing is not the threat. The real threat is the link being forwarded, which is why the referrer is stripped: the token never rides into someone else's server logs.

The gates, for when unlisted is not enough

SensitivityControl
Shareable but not indexedThe default: unlisted token, noindex, no-referrer
Only people with a secretset_password
Only one organisationset_email_gate
One read, then goneBurn-after-read
Nothing readable at rest by usEnd-to-end encryption — the key lives in the URL fragment

Checking it yourself

You do not have to trust the description. The robots posture is on the wire, and you can read it back:

curl -sI https://read.botook.ai/s/<token> | grep -i -E 'x-robots-tag|referrer-policy|content-security-policy'

If those headers are not what this page claims, that is a bug worth reporting — not a promise you were asked to take on faith.

Can the scan guarantee nothing leaks?

No — it is a backstop, not a proof. It blocks the common shapes of secrets before storage; the durable protections are the unlisted default, the gates, and end-to-end encryption when the content must be unreadable at rest.

Does the scan send my content anywhere?

No. It runs in the publish path on your own deployment. Nothing leaves your account to be scanned.

Keep reading