Secret entry mode: When BOSS activates secret entry mode, the input field becomes a masked password field. Your entry is displayed as ***secret*** in the transcript and sent only to the Credential Store — never to the AI chat endpoint.
AES-256-GCM encryption: Credentials are encrypted before writing to disk. The encryption key is derived from the environment. Plaintext secrets are never written to any file.
Live key rejection: Keys containing live_ or pk_live_ or rk_live_ are automatically rejected unless you explicitly allow live keys with owner authorization.
7-tier classification: Every credential is classified: SANDBOX_SECRET, LIVE_SECRET_OWNER_APPROVAL_REQUIRED, MCP_TOKEN, API_KEY, PASSWORD_OR_LOGIN_SECRET, PAYMENT_SECRET, or OTHER_SECRET.
No AI exposure: Raw secret values never reach /api/chat, LLM endpoints, audit logs, error messages, or screenshots.