secret-preflight: string withheld from the LLM because it held a secret

error — fails the build

During the --semantic pass, the privacy pre-flight found a secret or PII in a pair and did NOT send it to the LLM — it was withheld (fail-closed) and reported instead. Because the judge only ever transmits the pairs the pre-flight scans, nothing with a detected secret leaves your machine.

What triggers it

// en.json
{ "note": "Deploy key: -----BEGIN OPENSSH PRIVATE KEY----- ..." }
// → withheld from the model, flagged here

Fixed

// en.json — no credential in the copy
{ "note": "Add your deploy key in project settings." }

Why it matters

The BYO-LLM promise is that your strings stay yours; a secret in a string would otherwise be handed verbatim to your model provider the moment you run --semantic. This is the guard that keeps that promise.

How to fix it

Remove the secret from the source/translation string so the pair can be reviewed normally.

How to silence it

Only appears under --semantic. --severity secret-preflight=warning keeps the withhold behaviour but stops it failing the build.

Check for this in CI

npx @shipi18n/cli check ./locales -s en
# SARIF for inline PR annotations:
npx @shipi18n/cli check ./locales -s en -r sarif -o shipi18n.sarif

The structural checks need no API key. Findings of this rule link back to this page from the SARIF helpUri.

Related rules

• secret-detected — a secret or PII sitting in a locale string