redact

Documentation

Overview

Package redact removes secrets from text an app logs, shows or exports (spec §13, v1.0.9): API keys and tokens in URL queries, signatures of presigned URLs, passwords in proxy and other URLs, and bearer tokens. Apps pass every log line, error detail and diagnostics file through Text (or wrap errors with Error) before writing it.

log.Print(redact.Text(err.Error()))
u := redact.URL("https://x.googleapis.com/v2?key=AIza…&q=hi") // …?key=REDACTED&q=hi

Index

• Constants
• Variables
• func Error(err error) error
• func Text(s string) string
• func URL(raw string) string

Constants

const Mask = "REDACTED"

Mask replaces a secret.

Variables

var SecretParams = []string{
	"key", "api_key", "apikey", "api-key", "token", "access_token", "refresh_token", "id_token",
	"auth", "authorization", "password", "passwd", "pwd", "secret", "client_secret",
	"sig", "signature", "x-amz-signature", "x-amz-credential", "x-amz-security-token",
	"x-goog-signature", "x-goog-credential", "pin", "code",
}

SecretParams are the query parameters (lower case) whose values are secrets. Matching ignores case.

Functions

func Error

func Error(err error) error

Error wraps err so that its message is redacted (Text); errors.Is and errors.As still see the original.

func Text

func Text(s string) string

Text redacts every URL in s (URL), secret parameters outside URLs (token=…), Authorization headers and bearer tokens, and well-known key shapes (Google AIza…, OpenAI sk-…, Hugging Face hf_…, GitHub gh*_…, Slack xox*-…).

func URL

func URL(raw string) string

URL redacts one URL: the password of its user info (user:pass@ → user:REDACTED@; a lone user, which proxies use as a token, too) and the values of SecretParams in its query. Text that does not parse as a URL goes through Text.