redact

Documentation

Overview

Package redact scrubs credential-bearing tokens from strings before they are logged. It owns the canonical bcrypt-shape regex (config.IsBcryptHash delegates here) so the pattern has a single home, and it is a leaf package (no ze imports) so any tier may use it.

Index

• Constants
• func Command(cmd string) string
• func IsBcryptHash(s string) bool

Constants

const Placeholder = "<redacted>"

Placeholder replaces a redacted credential token in a log-safe string.

Functions

func Command

func Command(cmd string) string

Command returns a copy of a command line safe to log: every bcrypt-shaped token is replaced with Placeholder, and the value token immediately following a password-family key is replaced with Placeholder even when it is a non-bcrypt plaintext secret. A command with no credential token is returned unchanged (whitespace preserved). Redaction runs on the full command; callers truncate the result AFTER, so a secret straddling a truncation boundary can never half-leak.

func IsBcryptHash

func IsBcryptHash(s string) bool

IsBcryptHash reports whether s is a syntactically valid bcrypt hash.