redact

Documentation

Index

• Constants
• func Bytes(b []byte) []byte
• func ConfigurePII(cfg PIIConfig)
• func JSONLBytes(b []byte) ([]byte, error)
• func JSONLContent(content string) (string, error)
• func String(s string) string
• type PIICategory
• type PIIConfig

Constants

const RedactedPlaceholder = "REDACTED"

RedactedPlaceholder is the replacement text used for redacted secrets.

Functions

func Bytes

func Bytes(b []byte) []byte

Bytes is a convenience wrapper around String for []byte content.

func ConfigurePII

func ConfigurePII(cfg PIIConfig)

ConfigurePII sets the global PII redaction configuration. Pre-compiles patterns so the hot path (String → detectPII) does no compilation. Call once at startup after loading settings. Thread-safe.

func JSONLBytes

func JSONLBytes(b []byte) ([]byte, error)

JSONLBytes is a convenience wrapper around JSONLContent for []byte content.

func JSONLContent

func JSONLContent(content string) (string, error)

JSONLContent parses each line as JSON to determine which string values need redaction, then performs targeted replacements on the raw JSON bytes. Lines with no secrets are returned unchanged, preserving original formatting.

For multi-line JSON content (e.g., pretty-printed single JSON objects like OpenCode export), the function first attempts to parse the entire content as a single JSON value. This ensures field-aware redaction (which skips ID fields) is used instead of falling back to entropy-based detection on raw text lines, which would corrupt high-entropy identifiers.

func String

func String(s string) string

String replaces secrets and PII in s using layered detection: 1. Entropy-based: high-entropy alphanumeric sequences (threshold 4.5) 2. Pattern-based: gitleaks regex rules (180+ known secret formats) 3. PII detection: email, phone, address patterns (only when configured via ConfigurePII) A string is redacted if ANY method flags it.

Types

type PIICategory

type PIICategory string

PIICategory identifies a category of personally identifiable information.

const (
	PIIEmail   PIICategory = "email"
	PIIPhone   PIICategory = "phone"
	PIIAddress PIICategory = "address"
)

type PIIConfig

type PIIConfig struct {
	// Enabled globally enables/disables PII redaction.
	// When false, no PII patterns are checked (secrets still redacted).
	Enabled bool

	// Categories maps each PII category to whether it is enabled.
	// Missing keys default to false (disabled).
	Categories map[PIICategory]bool

	// CustomPatterns allows teams to define additional regex patterns.
	// Each key is a label used in the replacement token (uppercased),
	// and each value is a regex pattern string.
	// Example: {"employee_id": `EMP-\d{6}`} produces [REDACTED_EMPLOYEE_ID].
	CustomPatterns map[string]string
	// contains filtered or unexported fields
}

PIIConfig controls which PII categories are detected and redacted.