Documentation
¶
Overview ¶
Package redact provides credential-pattern scrubbing for strings shipped to upstream LLM providers, log sinks, or persisted fields. The function set is intentionally regex-based (vs. structured parsing) so it MUST be applied as a defence-in-depth layer alongside structured payload design, not as the only credential filter.
Pattern set is derived from backend-security-design.md §3.1 (cross-language rule). Even imperfect regex is better than nothing — coverage > precision.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ForLLM ¶
ForLLM scrubs known credential patterns from s, replacing each match with a labelled placeholder. Empty input returns empty string. Order of patterns is fixed and deterministic so the same input always produces the same redacted output (useful for snapshot tests + log-based audit).
The function MUST stay cheap (called per-tool-invocation in the MCP middleware path); regexes are compiled once at package init.
Types ¶
This section is empty.
Source Files