CLI safe guide

Use the Shhhs CLI without leaking secrets into shell history.

The CLI exists so operators and scripts can create controlled handoffs without putting secret values in command history, tickets, prompts, or CI logs.

01

Prefer hidden input

Use interactive hidden prompt mode for manual text pushes. Avoid passing secrets as command arguments because shells, terminals, process lists, and CI systems can record them.

  • Hidden prompt
  • No secret CLI args
  • No screenshots with plaintext

02

Use safe sources

For automation, prefer stdin, environment references, files, or dotenv references resolved locally by the CLI. The CLI should encrypt locally and print only handoff metadata and links.

  • stdin
  • env:NAME
  • file:/path

03

Team API keys

Team API keys authenticate automation and are separate from human login. Store them in local secret stores or CI secret managers, not in prompts, tickets, or public repositories.

  • Scoped keys
  • Show once
  • Max key hygiene

04

JSON output

Use JSON output for scripts, but treat links as sensitive metadata. Redact full links from logs unless the workflow explicitly requires a recipient handoff.

  • Machine readable
  • Redacted reports
  • No plaintext stdout

05

CI usage

CI should use short TTLs, view limits, and request links where possible. Do not put secrets in build output, artifacts, failed test logs, or chat notifications.

  • Short TTL
  • One-view where possible
  • No artifact leakage

06

Update and release posture

CLI updates are explicit. There is no background updater. Release artifacts should be validated by checksum and tested with the CLI smoke before broad use.

  • Explicit update
  • Checksum verification
  • cli:test

FAQ

Can this guide include private links?

No. Public guides never include secret identifiers, room ids, full private URLs, fragments, filenames, or payload-derived text.

Is this a certification or audit?

No. It is product documentation for deployed boundaries. External audits, DPAs, SLAs, and certifications require separate evidence and review.

Does Shhhs recover secrets?

No. Shhhs support can help with billing and metadata-only support, but cannot decrypt or recover secret content.