Droid Shield

What is Droid Shield?

Droid Shield is a built-in security feature that automatically scans un-committed changes for potential secrets before committing and pushing them to remote. It is a safety net that prevents accidental exposure of sensitive credentials like API keys, tokens, and passwords in your version control history.

Organization admins can enforce Droid Shield through Enterprise Controls. For the broader enterprise safety model, see Agent Safety & Controls.

How Droid Shield works

When you use Droid to perform git commit or git push operations, Droid Shield automatically:

1. 1
   Scans the diff - Analyzes only the lines being added (not removed or unchanged)
2. 2
   Detects secrets - Uses pattern matching to identify potential credentials
3. 3
   Blocks execution - Stops the git operation if secrets are detected
4. 4
   Reports findings - Shows exactly where potential secrets were found

What Droid Shield detects

Droid Shield scans for a wide range of credential patterns, including:

Detection algorithm

Droid Shield uses smart pattern matching with randomness validation:

• Pattern matching - Identifies credentials by format
• Randomness check - Validates that captured values look like actual secrets
• Context awareness - Considers variable names and assignment patterns to reduce false positives

Droid Shield 2.0: learned secret detection

Droid Shield 2.0 augments the deterministic scanner with two fine-tuned classification models that add a semantic layer on top of pattern-based detection. Every commit and push still passes through the deterministic scanner first; the models then classify specific contexts the scanner flagged or missed.

The two classification models

The models sit on opposite sides of the deterministic scanner and are optimized for distinct failure modes:

When Droid Shield activates

Droid Shield automatically activates during these git operations:

• git commit - Scans staged changes before creating the commit
• git push - Scans commits that would be pushed to the remote

Managing Droid Shield settings

In the CLI

You can toggle Droid Shield on or off through the settings menu:

1. 1
   Run droid
2. 2
   Enter /settings
3. 3
   Toggle "Droid Shield" setting
4. 4
   Changes take effect immediately

What to do if secrets are detected

When Droid Shield detects potential secrets, you'll see an error message like:

Droid-Shield has detected potential secrets in 2 location(s) across files:
src/config.ts, .env.example
 
If you would like to override, you can either:
1. Perform the commit/push yourself manually
2. Disable Droid Shield by running /settings and toggling the "Droid Shield" option

Recommended actions

1. 1
   Review the findings

   Carefully examine the files and lines mentioned to identify what was detected.

2. 2
   Remove the secrets

   • Use environment variables instead of hardcoded credentials
   • Move secrets to secure credential stores
   • Add sensitive files to .gitignore
   • Use git filter-branch or BFG Repo-Cleaner if secrets were already committed
3. 3
   Retry the operation

   Once secrets are removed, run the git command again through Droid.

If you get a false positive

Droid Shield uses conservative patterns to err on the side of caution. If you believe a detection is a false positive:

1. 1
   Verify it's not a real secret - Double-check that the value isn't sensitive
2. 2
   Use a manual commit - Perform the git operation yourself outside of Droid
3. 3
   Report the pattern - Contact support@factory.ai if you encounter recurring false positives

Best practices

Use environment variables

Store all secrets in environment variables or secure credential managers, never hardcode them in source files.

// Good - Using environment variable
const apiKey = process.env.FACTORY_API_KEY;
 
// Bad - Hardcoded secret
const apiKey = "never-hardcode-secrets";

Keep Droid Shield enabled

Droid Shield provides an essential safety layer. Keep it enabled at all times, especially in team environments.

Review before committing

Even with Droid Shield, manually review your changes before committing to ensure no sensitive data is included.

Educate your team

Make sure all team members understand how Droid Shield works and why it's important to keep it enabled.

Limitations