redact

package

v0.9.1 Latest Latest Go to latest Published: Jul 27, 2026 License: MIT Imports: 4 Imported by: 0

Details

Package redact applies layered, client-side secret redaction to captured session content BEFORE anything leaves the machine (SEC-3 / FR-12).

Three layers run in order:

Provider patterns — known token shapes (AWS, GitHub, OpenAI, Stripe, Slack, Google, private-key blocks, JWTs, generic "key = value" assigns).
High-entropy tokens — long base64/hex-ish runs whose Shannon entropy exceeds a threshold (catches secrets in tool output, diffs, pasted blobs that provider patterns miss).
Path excludes — lines referencing a glob in excludePaths are dropped.

Redaction is best-effort by design: the server runs an authoritative scanner too (SEC-3b). This layer minimizes egress; it is not the sole defense.

This section is empty.

This section is empty.

This section is empty.

type Result struct {
	Text    string
	Applied bool // true if any redaction (any layer) fired
}

Result reports what Redact produced.

func Redact(text string, excludePaths []string) Result

Redact runs the three layers over text and returns the redacted output. excludePaths drops whole lines that reference an excluded path glob.