Documentation
¶
Overview ¶
Package redact masks secrets out of captured evidence before it is stored, materialized into content-addressed objects, or exported into a signed forensics bundle.
The threat it addresses is concrete: the sensor captures raw agent activity verbatim — an execve's full argv (including a `curl -H "x-api-key: sk-..."`), and, once full-TLS-body capture lands, the plaintext of the agent's own LLM requests. Any of those can carry a live API key. Evidence flows to many sinks (the store, the dashboard, `--json` output, and a SIGNED, shareable bundle), so masking has to happen at capture/write time, not only when one sink renders — a single un-redacted export is a public leak.
Matching strategy: anchored provider-token patterns are PRIMARY. They key on the token's own high-entropy prefix (`sk-`, `ghp_`, `github_pat_`, `ASIA`, ...) so they fire regardless of serialization — the same key is caught whether it sits in a joined command string (`... x-api-key: sk-123 ...`) or an argv array where the header name and value are split across separate JSON tokens (`["x-api-key:","sk-123"]`). A key/value pattern is SECONDARY, for secrets that lack a recognizable prefix but appear next to a telltale field name; that pattern is applied by a scanner (not one regex) so it can also consume quoted values containing spaces, whole nested JSON objects/arrays, URL userinfo credentials and bare `?key=` query parameters.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Redact ¶
Redact masks secrets in s and reports whether anything was replaced. It is safe to run over a JSON payload string: token patterns match only the secret substrings, and the kv/URL scanners stop at quotes, backslashes and structural bytes, so the surrounding document stays well-formed.
func RedactHeaders ¶
RedactHeaders masks the values of credential-bearing headers in place and reports whether anything was masked. Used by tlsintent on a reassembled HTTP message's header map, where masking by name is precise.
func RedactLegacy ¶ added in v0.10.1
RedactLegacy masks secrets in s exactly as v0.10.0 did and reports whether anything was replaced. See the file comment: frozen compatibility shim for verifying historical evidence, never used on newly captured data.
func RedactString ¶
RedactString is Redact without the changed flag, for call sites that just want the safe string.
Types ¶
This section is empty.
Source Files