Reference

What it detects

Three detectors run over your transcripts. All are deterministic — no model is in the loop, and a command either matches a rule or it does not. The same input gives the same output on every run.

Credentials

Credential material appearing in recorded shell commands, grouped by fingerprint. The value is never stored or printed; id is sha256[:8] of it, so the same secret reused two hundred times counts once.

Detection is pattern-based, so it will miss things. It recognises the shapes of well-known credentials. A bespoke internal token with no distinguishing shape can pass unnoticed. Treat a clean report as “nothing matched”, not as “nothing is there”.

Shell audit

Nine deterministic categories over every recorded command, tuned to roughly a 4% flag rate by deleting rules as much as adding them. Categories include destructive filesystem operations, privilege escalation, remote code execution, credential handling and network reach.

Each flagged command is shown with the permission mode in force at the time, and every denial is recorded separately.

Coach findings

Eleven findings, each with evidence, an action, and an impact estimate where one is computable. Benchmarked against your own history, so no telemetry is needed and they work with a single user.

Ask why any of them fired against your data:

$ actualis --why AF004