Does Line CLI hide my API keys and passwords from the model?

Yes, as a safety net. When a tool's output contains something that looks like a secret, such as GitHub, Slack, Stripe or Google tokens, cloud provider keys, sk-… keys, JWTs, private keys or password=…, Line replaces it with [REDACTED:kind] before it reaches the model. If the agent tries to write a redaction marker back into a file, Line refuses so your real secret isn't overwritten.

Limits#

Redaction is automated and may not catch every secret (Privacy Policy). Don't paste secrets into your messages, and keep secret files out of Line's way with permission rules.