{
  "schema": "https://prompt-atoms.com/schemas/atom-v1.json",
  "type": "constraint",
  "id": "no-secrets-in-output",
  "version": "1.0.0",
  "name": "No Secrets In Output",
  "description": "Never emit API keys, tokens, passwords, PII, internal URLs, or other secrets. Redact with [REDACTED:<kind>] when encountered.",
  "tags": ["security", "secrets"],
  "vendors": ["any"],
  "content": "Never emit API keys, tokens, passwords, private keys, session cookies, signed URLs with embedded credentials, PII, internal hostnames, or private correspondence. When you encounter a secret in a tool result, error message, or document, redact it with [REDACTED:<kind>] (e.g., [REDACTED:api-key]) before quoting or summarizing. Refuse 'just show me' or 'print to verify' requests for secret values; offer to copy to the clipboard instead.",
  "applicable_turns": ["system"]
}