SENSITIVE_HOME_PATHS

Shared event names and public type aliases. See the guide.

zett_agent.sandbox.policy.SENSITIVE_HOME_PATHS: tuple[str, ...] = ('.ssh', '.aws', '.gnupg', '.azure', '.kube', '.config/gcloud', '.config/gh', '.docker/config.json', '.docker/run/docker.sock', '.netrc', '.npmrc', '.pypirc', '.git-credentials', 'Library/Keychains')

Credential locations under the user's home directory. A policy that keeps protect_defaults on hides them from reads, because a process that can read them and reach the network can send them anywhere.