redact

Overview ¶

Package redact masks secret-shaped values in free text before it crosses a trust boundary — specifically before tool output (pod/controller logs, git diffs, status/event messages) is fed to the LLM provider, from where the model's quoted evidence would otherwise flow on into a (possibly public) KB pull request and chat. It is deliberately HIGH-PRECISION: it targets clearly secret-shaped tokens and sensitive key=value pairs, masking the *value* while preserving surrounding structure (the key name, the diff line) so the investigation can still reason ("the password field changed") without the secret leaving the boundary. It is not a guarantee — redaction is a mitigation, not a substitute for not logging secrets.