diff --git a/server/redact.test.ts b/server/redact.test.ts
index 98ee2e6..e0ca7e9 100644
--- a/server/redact.test.ts
+++ b/server/redact.test.ts
@@ -168,6 +168,8 @@ describe("redactSecretsInText", () => {
       [`aws ${"AKIA" + "IOSFODNN7EXAMPLE"} and more`, /IOSFODNN7EXAMPLE/],
       [`google ${"AIza" + "SyA-"}${alpha.slice(0, 32)}`, /AIza/],
       [`npm ${"npm" + "_"}${alpha}`, /npm_[a-z]/],
+      [`box ${"box_" + "live_"}abcdefghijklmnop`, /box_live_[a-z]/],
+      [`webhook ${"whsec" + "_"}${alpha.slice(0, 32)}`, /whsec_[a-z]/],
     ];
     for (const [input, leak] of cases) {
       const out = redactSecretsInText(input);
diff --git a/server/redact.ts b/server/redact.ts
index c7d2126..556c00f 100644
--- a/server/redact.ts
+++ b/server/redact.ts
@@ -52,6 +52,8 @@ const KEY_PREFIXES: RegExp[] = [
   /\bAKIA[0-9A-Z]{16}\b/g, // aws access key id
   /\bAIza[0-9A-Za-z_-]{30,}/g, // google api key
   /\bnpm_[A-Za-z0-9]{20,}/g, // npm
+  /\bbox_[a-z]+_[A-Za-z0-9_-]{4,}/g, // ascii.dev box api token
+  /\bwhsec_[A-Za-z0-9_-]{20,}/g, // helmryth webhook secret
   /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, // jwt
 ];
 const BEARER = /(\bBearer\s+)([A-Za-z0-9._~+/=-]{12,})/g;