Placeholder shapes

Every placeholder is designed so it can never be mistaken for, or collide with, a real value. Where the structure of a value carries context that is useful but not identifying, that structure is preserved.

This is the same material redactproxy memory puts into an engagement’s CLAUDE.md, in more detail and written for you rather than for Claude. If you are wondering whether a strange-looking string in a session is a placeholder, this is the page.

Structure-preserving shapes

These keep part of the real value, because that part is useful to reason with and does not identify anyone.

A worked example:

mail.xyzcorp-fixture.internal  ->  mail.tok5198ede8bdbb1ada.internal
rahul.menon@xyzcorp-...        ->  user-428791a054d2@tok5198ede8bdbb1ada.internal
10.42.7.19                     ->  198.18.0.19

The subdomain, the shared org token across hostname and email, and the host octet all survive. That is what lets Claude reason about relationships between hosts without ever seeing whose they are.

Why these ranges

• 198.18.0.0/15 is RFC 2544 benchmarking space, reserved for network interconnect device testing and never publicly routed. It is used deliberately instead of an RFC 1918 range, because internal engagements routinely target real 10.x, 172.16-31.x and 192.168.x addresses, and the token space must not overlap real targets.
• fd00::/8 is RFC 4193 Unique Local Address space, never a real global address.
• 555-01XX is the NANP exchange reserved for fictional use under every area code, the same convention film and TV rely on. Placeholder numbers draw from a spread of real geographic area codes, so the token space is large enough for an engagement cataloging hundreds of extensions.

Important

A placeholder IP is not test data. The range is reserved because that is what makes it unmistakable, not because the address behind it is any less real or less sensitive. A finding on 198.18.7.19 is a finding on a real external target.

The shape invites the opposite inference, which is why the redactproxy memory note tells Claude explicitly not to discount or deprioritize one. A report that reaches you with placeholders still in it describes real targets, not lab hosts.

Credential shapes

These keep the vendor prefix, so the type of credential stays recognizable, and replace everything after it. Knowing you found an AWS key is useful; knowing which one is not.

FAKE is the anchor: K is not a valid hex digit, so FAKE can never appear inside a real random-hex secret. AWS in particular never allocates FAKE as the four characters after AKIA, so the placeholder is structurally non-issuable rather than just visually distinct.

Other shapes

Properties worth relying on

Stable. The same real value always maps to the same placeholder for the life of the engagement.

Random, not derived. Placeholders come from crypto/rand. There is nothing in one to reverse, and no information about the value it stands for. This is also why tokens remove followed by re-encountering the value produces a different placeholder.

Only safe copied verbatim. A placeholder has to be reproduced character for character, from its most recent literal appearance. One retyped from memory, fragmented into a bare subdomain plus suffix, or swapped for a hand-typed <angle bracket> stand-in silently breaks something downstream: an Edit’s old_string stops matching the real file, or a report line traces back to nothing. The same applies to placeholders you copy by hand.

An unfamiliar placeholder is not a bug. It is either a token doing its job, or an over-redaction of something merely domain-shaped (table.style, where .style is a real suffix). Either way the real value is substituted before execution, on every response rather than just the first, so the command runs correctly regardless. The real filesystem is ground truth here, since the proxy only ever inspects API traffic, which is why the memory note points Claude at Bash and Read rather than at reasoning around the token.

Capacity limits

Two placeholder spaces are counter-allocated rather than random, and one of them is finite:

• IPv4 networks: 256 per engagement. Each distinct real /24 gets one. An engagement touching more than 256 distinct /24 networks would be unusual, but if it happens the request that hits the 257th fails closed rather than reusing a placeholder.
• IPv6 networks: about 4.3 billion per engagement. No realistic exhaustion risk.

Everything else is drawn at random from a space large enough that collisions are handled by retry rather than being a design concern.