# Does mentioning a password in conversation trigger secret_leak?

No. secret_leak is anchored on what a live credential looks like, not on words like "password" or "API key" showing up in a sentence. A user asking how to reset their password, or an agent explaining what an API key is, doesn't trip it.

What does trip it is the shape of an actual secret: a provider key prefix, a private-key block header, a session token, or an assignment like `api_key=` or `password:` followed by something that looks like a live value. That's deliberate. A rule broad enough to catch every mention of the word "password" would flag a large share of ordinary support conversations and bury the real detections in noise.

It also means a fake or example credential shaped like a real one can still trigger a flag. The check reads the pattern, not whether the value actually works.

---

Source: https://tessary.ai/answers/tessary-secret-leak/does-mentioning-a-password-trigger-secret-leak
More on Tessary secret leak: https://tessary.ai/answers/tessary-secret-leak
From Tessary, agent reliability for AI agents in production: https://tessary.ai