redact

Documentation

Overview

Package redact applies layered, client-side secret redaction to captured session content BEFORE anything leaves the machine (SEC-3 / FR-12).

Three layers run in order:

1. Provider patterns — known token shapes (AWS, GitHub, OpenAI, Stripe, Slack, Google, private-key blocks, JWTs, generic "key = value" assigns).
2. High-entropy tokens — long base64/hex-ish runs whose Shannon entropy exceeds a threshold (catches secrets in tool output, diffs, pasted blobs that provider patterns miss).
3. Path excludes — lines referencing a glob in excludePaths are dropped.

Redaction is best-effort by design: the server runs an authoritative scanner too (SEC-3b). This layer minimizes egress; it is not the sole defense.

Index

• type Result
  • func Redact(text string, excludePaths []string) Result

Types

type Result

type Result struct {
	Text    string
	Applied bool // true if any redaction (any layer) fired
}

Result reports what Redact produced.

func Redact

func Redact(text string, excludePaths []string) Result

Redact runs the three layers over text and returns the redacted output. excludePaths drops whole lines that reference an excluded path glob.