# A transform. The detector reported spans; this rule decides that any span at
# all is too many. Compare redact-pii.yaml: both fire, and both apply.
oar: "1.0"
id: REDACT_SECRETS
namespace: example.security
kind: detector
anchor: model.output
requires:
  profiles: [secrets]
detector:
  ref: detector://fixture
when: 'size(secret_matches) > 0'
effect: transform
transform:
  action: redact
  target: secret_matches
  replacement: "[secret redacted]"
status: stable
copy:
  what: The response contained something shaped like a credential.