Does secret_leak see credentials in inner tool calls, or only the final response?

Everything, not just the final answer. secret_leak reads every span in a trace, including the inner tool calls a user never sees, and checks any output that reaches logs or gets fed into a downstream prompt as it happens.

That matters because a leaked credential rarely shows up in the polished final message. It shows up in the tool call that read a config file, the intermediate step that echoed a header back into the agent’s own context, or a retry that logged a raw response after a failed request. A classifier that only checked the final response would miss most of that.

The tradeoff is the same one every Tessary classifier makes: it’s a narrow, cheap check on one property, run on every span instead of a sample, not a review of what the trace as a whole was trying to do.