add

Author: motdotla

_data/features.yml

@@ -15,7 +15,7 @@ items:
   - label: Ship the right secrets to each environment
     meta: dotenvx run -f .env.production
     href: /docs/quickstart/environments
-  - label: Let agents use secrets without spilling them
+  - label: Runtime leak protection and log redaction
     meta: dotenvx run --redact -- claude
     href: /docs/cli/run-redact
   - label: Catch missing keys before you run

_data/features_page.yml

@@ -18,7 +18,7 @@ items:
   - label: Compose multiple .env files
     meta: dotenvx run -f
     href: /docs/cli/run-f
-  - label: Let agents use secrets without spilling them
+  - label: Runtime leak protection and log redaction
     meta: dotenvx run --redact -- claude
     href: /docs/cli/run-redact
   - label: Catch missing keys before you run
@@ -66,13 +66,13 @@ items:
   - label: Pull secrets remotely from Bitwarden
     meta: bw://..
     href: /docs/bitwarden
-  - label: Use secrets with Claude
+  - label: Runtime leak protection with Claude
     meta: dotenvx run --redact -- claude
     href: /docs/claude
-  - label: Use secrets with Cursor
+  - label: Runtime leak protection with Cursor
     meta: dotenvx run --redact -- agent
     href: /docs/cursor
-  - label: Use secrets with Codex
+  - label: Runtime leak protection with Codex
     meta: dotenvx run --redact -- codex
     href: /docs/codex
   - label: and more

_data/search.yml

@@ -40,15 +40,30 @@ entries:
       - anthropic
       - claude code
       - secrets in claude
+      - runtime leak protection
+      - log redaction
   /docs/cursor/:
     boost: 75
     aliases:
       - secrets in cursor
+      - runtime leak protection
+      - log redaction
   /docs/codex/:
     boost: 75
     aliases:
       - openai
       - secrets in codex
+      - runtime leak protection
+      - log redaction
+  /docs/cli/run-redact/:
+    boost: 80
+    aliases:
+      - redact
+      - --redact
+      - runtime leak protection
+      - log redaction
+      - secret redaction
+      - redact secrets from logs
   /docs/cli-quickstart/:
     boost: 65
     aliases:

_includes/components/design-settings-tile.html

@@ -3,8 +3,9 @@
 {% assign icon = include.icon %}
 {% assign glyph = include.glyph %}
 {% assign tile_class = include.class %}
+{% assign aria_label = include.aria_label | default: include.title | default: label %}
 
-<a class="design-settings-tile{% if tile_class %} {{ tile_class }}{% endif %}" href="{{ href }}"{% if label and label != "" %} aria-label="{{ label }}"{% endif %}>
+<a class="design-settings-tile{% if tile_class %} {{ tile_class }}{% endif %}" href="{{ href }}"{% if aria_label and aria_label != "" %} aria-label="{{ aria_label }}"{% endif %}{% if include.title %} title="{{ include.title }}"{% endif %}>
   {% if label and label != "" %}
     <span class="design-settings-tile-label">{{ label }}</span>
   {% endif %}

_includes/components/home-trust.html

@@ -51,6 +51,14 @@
             rel="noopener noreferrer"
           >Supabase</a>
         </li>
+        <li>
+          <a
+            class="design-link"
+            href="https://github.com/search?q=org%3Abetagouv+dotenvx&type=code"
+            target="_blank"
+            rel="noopener noreferrer"
+          >Republic of France</a>
+        </li>
         <li>
           <a
             class="design-link"

docs/advanced/index.md

@@ -48,18 +48,23 @@ layout: radar
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact">run --redact</a>
+    <span class="design-list-meta">runtime leak protection &amp; log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-claude-print">run --redact -- claude -p</a>
+    <span class="design-list-meta">log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-claude">run --redact -- claude</a>
+    <span class="design-list-meta">runtime leak protection</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-codex-exec">run --redact -- codex exec</a>
+    <span class="design-list-meta">log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-codex">run --redact -- codex</a>
+    <span class="design-list-meta">runtime leak protection</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-mask">run --mask</a>

docs/claude.md

@@ -1,8 +1,8 @@
 ---
 layout: docs-quickstart
 title: "Claude Code"
-social_title: "Redact secrets from Claude coding agents"
-description: "Redact secrets from your Claude coding agents and prevent them from leaking into logs."
+social_title: "Runtime leak protection for Claude coding agents"
+description: "Runtime leak protection and log redaction for Claude Code. Give Claude real secrets while redacting them from output, terminals, and agent transcripts."
 icon: claude
 permalink: /docs/claude/
 redirect_from:
@@ -24,7 +24,7 @@ encrypt_copy: 'echo "HELLO=World" > .env'
 encrypt: |
   $ echo "HELLO=World" > .env
 inject_title: "3. Run Claude with redaction"
-inject_lede: "Run Claude with your real secrets while redacting them from its output."
+inject_lede: "Runtime leak protection: Claude gets real secrets, while log redaction strips them from its output."
 inject_copy: "dotenvx run --redact -- claude -p 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --dangerously-skip-permissions"
 inject: |
   $ dotenvx run --redact -- claude -p 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --dangerously-skip-permissions

docs/cli/index.md

@@ -56,18 +56,23 @@ layout: radar
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact">run --redact</a>
+    <span class="design-list-meta">runtime leak protection &amp; log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-claude-print">run --redact -- claude -p</a>
+    <span class="design-list-meta">log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-claude">run --redact -- claude</a>
+    <span class="design-list-meta">runtime leak protection</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-codex-exec">run --redact -- codex exec</a>
+    <span class="design-list-meta">log redaction</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-redact-codex">run --redact -- codex</a>
+    <span class="design-list-meta">runtime leak protection</span>
   </li>
   <li>
     <a class="design-link" href="/docs/cli/run-mask">run --mask</a>

docs/cli/run-redact-claude-print.md

@@ -3,7 +3,7 @@ layout: docs-cli
 title: "--redact -- claude -p"
 eyebrow: "dotenvx run"
 eyebrow_href: /docs/cli/run/
-description: Run Claude in print mode while redacting injected values from its output.
+description: Runtime leak protection and log redaction for Claude print mode. Run Claude non-interactively with real secrets while redacting them from output and logs.
 permalink: /docs/cli/run-redact-claude-print/
 redirect_from:
   - /docs/ref/cli/run-redact-claude-print/
@@ -17,7 +17,7 @@ crumbs:
     href: /docs/cli/run/
 video: https://github.com/user-attachments/assets/36cdfe6b-429a-4cb7-a087-894c5f043a2b
 ---
-Claude receives the real environment variables, but any matching values it prints are replaced with `[REDACTED]`.
+Runtime leak protection for Claude print mode: Claude receives the real environment variables, but log redaction replaces any matching values it prints with `[REDACTED]`.
 
 {% capture cli_code_0 %}
 $ echo "SECRET=super-secret-value" > .env

docs/cli/run-redact-claude.md

@@ -3,7 +3,7 @@ layout: docs-cli
 title: "--redact -- claude"
 eyebrow: "dotenvx run"
 eyebrow_href: /docs/cli/run/
-description: Start an interactive Claude session while redacting injected values from its output.
+description: Runtime leak protection and log redaction for Claude Code. Start an interactive Claude session with real secrets while redacting them from output and transcripts.
 permalink: /docs/cli/run-redact-claude/
 redirect_from:
   - /docs/ref/cli/run-redact-claude/
@@ -17,7 +17,7 @@ crumbs:
     href: /docs/cli/run/
 video: https://github.com/user-attachments/assets/36cdfe6b-429a-4cb7-a087-894c5f043a2b
 ---
-Claude receives the real environment variables, but any matching values it prints are replaced with `[REDACTED]` throughout the interactive session.
+Runtime leak protection for Claude Code: Claude receives the real environment variables, but log redaction replaces any matching values it prints with `[REDACTED]` throughout the interactive session — so secrets stay out of the terminal and agent transcript.
 
 {% capture cli_code_0 %}
 $ echo "SECRET=super-secret-value" > .env