Feature Request: Warn users before sending messages containing sensitive information

Feature Request: Warn users before sending messages containing sensitive information

Summary

While using Rocket.Chat, users occasionally paste sensitive information into a conversation without realizing it. This can include API keys, passwords, access tokens, private SSH keys, database connection strings, or other confidential credentials.

Once the message is sent, the information becomes visible to everyone with access to that conversation and may remain in the chat history even if the sender deletes it later.

It would be helpful if Rocket.Chat could detect common sensitive data patterns before sending a message and display a confirmation dialog, allowing users to review their message before accidentally exposing confidential information.

---

Current Behavior

When a user pastes sensitive information into the message composer and clicks Send, the message is immediately delivered without any warning.

For example:

AWS_SECRET_ACCESS_KEY=AKIA...

password=Admin@123

Bearer eyJhbGciOiJIUzI1Ni...

-----BEGIN PRIVATE KEY-----

If this was pasted unintentionally or into the wrong channel, there is no opportunity to catch the mistake before it reaches other users.

---

Expected Behavior

Before sending the message, Rocket.Chat could perform a lightweight client-side scan for commonly exposed secrets.

If a possible credential is detected, display a confirmation dialog such as:

Sensitive information detected

Your message appears to contain confidential information such as an API key, password, access token, or private key.

Are you sure you want to send this message?

Buttons:

• Edit Message
• Send Anyway

The warning should not block the user from sending the message—it should simply provide an additional confirmation step.

---

Possible Detection Patterns

Initially, the feature could detect a small set of common patterns, such as:

• AWS Access Keys
• Bearer Tokens
• JWT Tokens
• Private SSH Keys
• Password assignments (for example, password=...)
• Database connection strings
• Generic API keys

The list could be expanded over time as needed.

---

Benefits

• Helps prevent accidental credential leaks.
• Improves security awareness without affecting normal messaging.
• Especially valuable for enterprise environments where developers, DevOps engineers, and IT teams frequently share technical information.
• Requires no server-side changes if implemented entirely on the client.

---

Additional Consideration

To avoid interrupting experienced users, an optional workspace setting or personal preference could allow administrators or individual users to enable or disable this warning based on their organization's needs.

Overall, I believe this would be a valuable usability and security enhancement that helps users catch accidental mistakes before sensitive information is shared.

Sample output

No files, tests, or entry points are named. Start by tracing the message composer’s send flow, then define the initial detection patterns and confirmation behavior; done means suspected credentials trigger an editable warning with “Send Anyway” while ordinary messages send normally.