sanitize-jwt

━━ when it runs

• PostToolUseafter the tool has already run. it cannot edit or redact the output — on codex and copilot a denial replaces the result the model reads; on claude it is appended beside the real output; on most other agents it is recorded and the model never sees it.

watchesevery tool the event fires for — not narrowed to particular tools

this pack enforces: a match returns a real denial rather than being recorded and discarded. what the denial then does depends on the event above.

━━ install

this one is on by default — taking the pack without flags turns it on, and the picker shows it pre-ticked.

• just this policy$failproofai policies add FailproofAI/policies --policy sanitize-jwt⧉ copy
• the whole pack$failproofai policies add FailproofAI/policies⧉ copy
• turn just this off$failproofai policies remove sanitize-jwt⧉ copy
• pick from a list$failproofai policies add⧉ copy
• uninstall the pack$failproofai policies remove FailproofAI/policies⧉ copy

ships in FailproofAI/policies · v06b802b63f4f · source ↗

━━ also in sanitize

• sanitize-api-keysStop Claude from reading API keys (OpenAI, Anthropic, GitHub, AWS, Stripe, Google) in tool responses
• sanitize-connection-stringsStop Claude from reading database connection strings with embedded credentials in tool responses
• sanitize-private-key-contentStop Claude from reading PEM private key content in tool responses
• sanitize-bearer-tokensStop Claude from reading Authorization Bearer tokens in tool responses