Spot on — runtime vaults/proxies are the gold standard. If devs never see raw keys (just masked refs or scoped tokens), the 2am paste risk vanishes. Tools like API Stronghold that enforce this are exactly the right prevention layer.

But the pre-poisoning problem runs deeper: even with perfect outbound sanitization today, the model is already tainted by years of unsanitized pastes from the broader ecosystem (docs, forums, code samples). Our EPHEMERAL_KEY leaks surfaced without any real key in the prompt — just semantic probing triggered training-data bleed of the Realtime API structure (ek_ prefix, TTL hints, client-side usage).

So vaults stop future leaks; detection (continuous variant probing) finds what already escaped.

The EPHEMERAL_KEY pattern didn't just leak the name — it leaked architectural details: - The `ek_` prefix pattern - That keys are "ephemeral" (short-lived session tokens) - The Realtime API context (where they're used) - Implicit TTL expectations - XXXXXXXXXXXX

Regex catches `sk-proj-...` going OUT, but not the model describing how keys work from training data.

Question back: Have you seen cases where models leak "vaulted" patterns (e.g., masked refs or token scopes) from prior training? That could close the loop.

Appreciate the insight — sharpening the approach.