Fix common findings

A credential file read, but the values are only for development

A project file such as .env.test holds placeholders or development values, and Guard reports an agent reading it.

• What Guard does. The sensor sees the file being opened. It never sees the contents, so it can't tell a placeholder from a real key.
• Already excluded. .env.example, .env.sample, .env.template, .env.dist and .env.defaults do not produce a finding.
• Fix for now. An administrator adds a scoped exception, below.

When an agent's hook saw a credential file's contents and Guard's secret patterns found only placeholders such as changeme, the Console shows that file read as Low with "Contents looked like placeholders". A real-looking secret keeps its usual severity, and your organization's severity override always wins. By default Guard's hooks block agents from reading .env files, so this applies where your organization allows such reads, for example through an exception; output from a shell command such as cat .env isn't checked.

Add a scoped exception

An exception lets a hook decision past for one detection, only where its scope matches.

1. Open Detection tuning. Choose New exception, or Propose exception from the finding.
2. Choose the detection credential_file_read_by_agent. It lets past a credential kind, such as dot_env.
3. Under Paths, list the project or development paths, one per line. Each path needs at least two literal directories or files before any **, so ~/src/** is refused. Commands and MCP servers are not used for this detection.
4. Optionally narrow it to harnesses, devices or a device group. With nothing ticked it covers every harness and device.
5. Set an expiry and a reason. An exception expires within 90 days, and the reason goes into the audit log.
6. Choose Preview the last 14 days to see how many findings it would have covered, then Propose exception.

An administrator's proposal is approved at once, unless it covers a finding in an open high or critical incident. Then a second administrator must approve it. An analyst's proposal waits for an administrator.

It reaches devices only when the next policy version holding it is published. Reading a whole credential directory and running a credential command cannot take an exception.

Keychain or credential command denied

• Shows: a hook denies a command such as security find-generic-password.
• Why: an agent asked for a credential from the Keychain or another store.
• Fix: no exception covers a credential command. Run it yourself, outside the agent, and give the agent only what it needs.

Sync fails: timestamp outside the allowed window

• Shows: Guard Cloud refuses the device's requests, and the device shows as offline or unknown.
• Why: the device clock is off. Requests carry a timestamp, and Guard Cloud refuses any more than 5 minutes from its own.
• Fix: correct the device clock, then run guard cloud sync again.

Hooks not installed

• Shows: Console coverage reports hooks missing, or an agent's tool calls are not checked.
• Why: hooks were never installed, or a harness update rewrote its configuration.
• Fix: as the user, run guard hooks install all, then guard hooks status. If entries went missing later, run guard hooks repair all.