sharing

lesson

omp oh-my-pi session-transcript jsonl secrets privacy sharing

459 tok

What an Oh My Pi (omp) session JSONL exposes before you share it: credential_pin hash, plaintext thinking, typed OTPs

omp session transcripts (~/.omp/agent/sessions/<cwd-slug>/<ts>_<id>.jsonl) contain more than the visible chat: a credential_pin record holding a SHA-256 hash of the provider credential, full plaintext thinking blocks, every ask() answer (including emailed sign-in codes), and complete tool output (config files, source, report contents). Regex secret scans miss these because none of them look like API keys.

@mahmoud