Git secret guard
Collections are plain text in git, which makes it easy to commit a token by accident. Vegha watches for that.
In the editor
Section titled “In the editor”A plain-text secret in a .bru file, such as a bearer token, API key or password, gets a
warning squiggle. The quick fix (Ctrl+.) swaps the value for a {{variable}} and copies
the original value to your clipboard, so you can paste it into an environment as a secret
variable.
In Source Control
Section titled “In Source Control”If you stage a .bru file that still contains a plain-text secret in VS Code’s Source
Control view, Vegha warns you before you commit it.
Detection uses the engine’s secret patterns, the same rules as the desktop app’s pre-commit check.
Where secrets should live
Section titled “Where secrets should live”- Secret variables in a
.env.jsonenvironment. Their values are kept in the encrypted store, not the file. secret://references resolved from Azure Key Vault or AWS Secrets Manager when the request is sent.