redaction

package

v0.1.1 Latest Latest Go to latest Published: Jul 14, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Details

Package redaction sanitizes application-layer observations before any persistence boundary. It never returns a hash of a detected secret.

View Source

const Replacement = "[REDACTED]"

This section is empty.

This section is empty.

type Finding struct {
	RuleID string
	Count  int
}

type Redactor struct {
	// contains filtered or unexported fields
}

func New(extraNames []string, canaries [][]byte) (*Redactor, error)

func (redactor *Redactor) AssertNoCanary(raw []byte) error

func (redactor *Redactor) RedactHeaders(headers http.Header) (http.Header, Report)

func (redactor *Redactor) RedactJSON(raw []byte) ([]byte, Report, error)

func (redactor *Redactor) RedactText(raw []byte) ([]byte, Report)

func (redactor *Redactor) RedactURL(input *url.URL) (*url.URL, Report, error)

func (redactor *Redactor) SanitizeJSON(raw []byte) (SanitizedPayload, error)

func (redactor *Redactor) SanitizeText(raw []byte) (SanitizedPayload, error)

type Report struct {
	Findings []Finding
}

func (report Report) Empty() bool

type SanitizedPayload struct {
	// contains filtered or unexported fields
}

SanitizedPayload is the only payload type accepted by the evidence CAS. Its bytes are unexported so callers must pass through a Redactor constructor.

func (payload SanitizedPayload) Bytes() []byte

func (payload SanitizedPayload) Class() string

func (payload SanitizedPayload) Report() Report

func (payload SanitizedPayload) Size() int