Skip to main content

​
Never in a snapshot

Files whose names match secret patterns are left out of every snapshot: .env, .env.*, *.pem, *.key, *.p12, *.pfx, *.keystore, *.jks, id_rsa*, id_ed25519*, id_ecdsa*, id_dsa*. Untracked files over 5 MB are left out too. The list is in ~/.payback/excludes and applies to every repository.
Prompts and transcripts are recorded as they are. Anything you type, or an agent reads and prints, is uploaded unfiltered. Keep secrets out of prompts, and exclude any repository you don’t want recorded. We redact what we find during review.

​
Never recorded at all

  • Repositories your allow list doesn’t cover. Setup’s default covers public GitHub repositories only. A private repository is recorded only if you name it yourself, and even then it never becomes an environment.
  • Anything outside a git repository with a GitHub origin. Not the turn, not the transcript.
  • Excluded repositories. A .payback-ignore file at the root, or a !owner/name line on the list, wins over everything else.
  • Anything while paused. payback pause stops every hook until payback resume.
Which repositories are recorded has the rules and the command that sets them.

​
Never shared

A lab receives the public repository, the prompts and the transcript, with no account information attached: not your name, email, GitHub login or payment details.