---

gitlab.com/phpboyscout/go/redact redacts credential-like content from free-form strings at the boundary between trusted and untrusted observability surfaces, such as telemetry vendors, log aggregators and metric stores. Error messages, command arguments, and HTTP header values routinely carry secrets by accident (a URL with embedded userinfo, an --api-key=sk-… flag in os.Args, an Authorization header quoted in an export error). Route those through redact.String on the way out and they never leave the process in the clear.

Design

• Zero dependencies. Pure standard library (regexp, strings), so nothing but the module enters your graph. A depfootprint_test.go guard enforces it, and holds the tests to testify and the estate's go/errors.
• Boundary redaction. Sanitise where data leaves the host, not everywhere.
• Conservative by default. The opaque-token fallback requires ≥41 chars so it never false-positives on UUIDs, MD5, or SHA-1.

Install

go get gitlab.com/phpboyscout/go/redact

Usage

import "gitlab.com/phpboyscout/go/redact"

safe := redact.String("failed calling https://user:[email protected]?api_key=sk-abc123…")
// → credentials in the URL userinfo, the api_key query param, and the sk- token are masked

msg := redact.Error(err) // redact.String applied to err.Error() (nil-safe)

if redact.IsSensitiveHeaderKey("Authorization") { /* … redact this header's value … */ }

redact.String strips URL userinfo for any scheme (https://, postgres://, redis://, …), credential name=value assignments, JSON credential fields such as "access_token" and "client_secret", Authorization-header tokens, JWTs, well-known provider prefixes (sk-, ghp_, glpat-, AIza, AKIA, Slack), and long opaque tokens. SensitiveHeaderKeys / IsSensitiveHeaderKey identify headers whose values should be redacted.

Limitations

Pattern catalogues never reach 100% recall, and this one is deliberately conservative:

• No configuration. You cannot add, disable or reorder a pattern. The package exports four symbols and nothing to tune. Compose around it instead.
• String does not mask arbitrary header values. It knows Authorization: and nothing else; X-API-Key: … passes through. That is what the header symbols are for.
• Bespoke and short secrets slip through. The catch-all fallback needs 41 characters, and each provider prefix has a hard minimum length.
• Patterns are ASCII-only, and redaction is one-way: nothing to reverse and no record of what was replaced.

What redact does not do states the full boundary.

Documentation

Full guides, reference and threat model: redact.go.phpboyscout.uk. Generated API docs and runnable examples: pkg.go.dev.

License

See LICENSE.