Paths/Codex Engineer/Review & Guardrails / Sandbox & Secrets
Scan a Diff for Secrets
A generated diff can contain a credential that was in the context. Write the scan that catches it before the commit leaves the machine.
Validator
⏱ 0:00
IDLE — checks run live as you type commands; submit when done
01Requirements
live checks- File ~/codex/secret-scanner.sh exists○
- The script inspects the diff○
- The script looks for access keys and private keys○
- The script exits non-zero when it finds one○
02Walkthrough
1 of 4 revealed- 01
Create the codex directory
The scanner lives with the policies it enforces.
mkdir -p ~/codex - 3 locked · each failed submit reveals one
03Stuck?
0 of 3 revealedTake a hint without losing the lab — each one points at the thing to look at, not at the answer.
04AI Tutor
guides, never solvesTell me what you're stuck on — I'll nudge, not solve. Which requirement are you looking at?
04Notebook
saved locally in this browserlearner@lab — ubuntu:24.04
Session is disposable
↑/↓ recalls commands · Ctrl+Enter submits · type help for the command list