sensitive

Overview ¶

Package sensitive holds a process-wide registry of secret values that must never appear in any log line, error message, or stdout output.

Usage:

token := os.Getenv("CLOUDFLARE_API_TOKEN")
sensitive.Register(token)            // ← BEFORE token reaches any code path that may log
scrubbed := sensitive.Scrub(message) // applied automatically by the shared Logger

Any value passed to Register is replaced with "***" wherever it appears in strings passed through Scrub. Values shorter than minRedactLen are ignored to avoid scrubbing common short tokens (e.g. account IDs that may legitimately appear in URLs).