Every secret your agent touches gets written down somewhere you don't control and can't purge. Not in a log you rotate — in a conversation that is stored, replayed, summarised, and shared.
The task succeeded. A live publish credential is now sitting in a document that will outlive the task by years.
Same outcome. The agent got a working credential; the record got a reference that is inert without access you control separately.
Every other place a secret escapes to has a remedy. This one has four properties that break all of them.
A secret committed to Git can be purged and force-pushed. A secret in a transcript is in a record you don't own the storage for, with no equivalent of git filter-repo.
Transcripts are re-read on every turn, restored when a session resumes, and summarised into new contexts. One paste is read back hundreds of times across places you never sent it.
Sessions end up in screenshots, bug reports, support threads, and pasted into other chats to ask what went wrong. Each hop is a copy you can't recall.
There is no scanner for this, no push protection, no alert. A credential in a transcript looks exactly like a credential doing its job, right up until it isn't.
Agents deploy things, publish packages, query production, and call APIs. Those tasks need credentials. Telling someone not to supply one is telling them not to use the tool for the work they bought it for — so they paste it anyway, at the moment they are most focused on something else.
The mistake is treating this as a discipline problem. It's an interface problem: the agent needs the capability, not the value. Handing over the value is just the only way we've offered.
Something still has to authorize the fetch — usually the machine's own cloud credentials. SecRefs converts one long-lived token in a permanent document into a short-lived credential scoped by your existing identity provider. Strictly better, not zero.
Resolution puts a real value in the process. If the agent then echoes it, it's in the transcript again. This closes the path secrets normally escape through — config, environment, pasted setup — not deliberate output.
Anything with code execution on the machine can read the resolved value out of memory, exactly as it could read a token from .env. The threat this addresses is the record, not the host.
Works with the vault you already run — AWS Secrets Manager, HashiCorp Vault, Bitwarden. SecRefs stores nothing and never holds a copy of your secrets.
npm install @secrefs/node · pip install secrefs