Does mentioning a password in conversation trigger secret_leak?

No. secret_leak is anchored on what a live credential looks like, not on words like “password” or “API key” showing up in a sentence. A user asking how to reset their password, or an agent explaining what an API key is, doesn’t trip it.

What does trip it is the shape of an actual secret: a provider key prefix, a private-key block header, a session token, or an assignment like api_key= or password: followed by something that looks like a live value. That’s deliberate. A rule broad enough to catch every mention of the word “password” would flag a large share of ordinary support conversations and bury the real detections in noise.

It also means a fake or example credential shaped like a real one can still trigger a flag. The check reads the pattern, not whether the value actually works.