Documentation
¶
Overview ¶
Package privacy provides utilities for protecting sensitive data.
Package privacy provides privacy tag handling for engram.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Clean ¶
Clean performs full privacy cleaning on text. This is the main function to use before storing any user content.
func ContainsSecrets ¶
ContainsSecrets checks if the given text contains any patterns that look like secrets. Returns true if potential secrets are detected.
func IsEntirelyPrivate ¶
IsEntirelyPrivate checks if the text is entirely within <private> tags.
func RedactSecrets ¶
RedactSecrets replaces detected secrets with a redaction marker that includes a SHA-256 hash prefix for cross-referencing with ExtractSecrets output. The hash allows correlating redacted values with their vault entries without exposing the secret itself.
func StripAllTags ¶
StripAllTags removes both private and memory context tags.
func StripMemoryTags ¶
StripMemoryTags removes all <engram-context>...</engram-context> content from text.
func StripPrivateTags ¶
StripPrivateTags removes all <private>...</private> content from text.
Types ¶
type DetectedSecret ¶ added in v0.4.0
type DetectedSecret struct {
Name string // deterministic: "auto:{sha256hex}" (64 hex chars)
Value string // the raw secret value
}
DetectedSecret represents a secret value found in text, with a deterministic name derived from the full SHA-256 hex of the value (64 hex chars) to avoid collisions when used as a vault deduplication key.
func ExtractSecrets ¶ added in v0.4.0
func ExtractSecrets(text string) []DetectedSecret
ExtractSecrets scans text for secret patterns and returns all unique matches. Each secret gets a deterministic name based on the SHA-256 hash of its value, ensuring idempotent vault storage (same secret = same name = one entry).
Source Files