Block a call outright if it contains a secret

secrets({ mode: "block" }) throws instead of masking -- for pipelines where a leaked key means the call should never go out at all.

import { Klaro, secrets } from "@klaroshield/sdk";
import OpenAI from "openai";

const openai = new OpenAI();

const klaro = new Klaro().use(
  secrets({ mode: "block" })
);

const chat = klaro.wrap(
  openai.chat.completions.create.bind(openai.chat.completions)
);

// Throws before any network call is made if the prompt contains
// something that looks like an API key, JWT, or bearer token.

More in Secrets & PII