Documentation
¶
Overview ¶
Package scrub removes secret values from anything leaving devbay.
The rule it enforces is that a secret never enters model context: not in a manifest, not in a prompt, not in logs returned to an agent. Everything upstream tries to make that true by construction -- secrets are references until spawn time, and the manifest rejects literals -- but an application will happily print its own configuration, and an error message from a third-party SDK will happily quote the credential it just used.
So this is the last line rather than the only one. It works from the exact values the broker resolved, which is the one thing a pattern matcher cannot know, and falls back to shape-based detection for credentials that were never handed out by devbay at all.
Index ¶
Constants ¶
const Redaction = "[redacted]"
Redaction is what replaces a secret. It names the reference rather than the value where one is known, so a developer reading a scrubbed log can still tell which credential was involved.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Scrubber ¶
type Scrubber struct {
// contains filtered or unexported fields
}
Scrubber removes known secret values and credential-shaped strings.
The zero value is usable and does shape-based scrubbing only.
func (*Scrubber) Add ¶
Add registers a secret value and the reference it came from.
Short values are ignored: a one- or two-character "secret" would match everywhere and redact the whole log into uselessness, which is its own kind of failure.
Source Files