Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
redact — Zero-dependency Go library stripping credential-like patterns (API keys, JWTs, Authorization headers, URL userinfo) before they reach logs/telemetry. | Kitploit
Tools/GitLabGitLab/phpboyscout/go/redact
Defensive ToolsPrivacySecret DetectionLog Analysis
GitLabphpboyscout/go/redact

redact

Zero-dependency Go library stripping credential-like patterns (API keys, JWTs, Authorization headers, URL userinfo) before they reach logs/telemetry.

View Repository
20h 26m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

redact

Strip credential-like content from free-form strings before they reach logs, telemetry, or any third-party surface

Go Reference Pipeline Coverage phpboyscout Go toolkit

Part of the phpboyscout Go toolkit — small, framework-free Go modules extracted from go-tool-base. Docs: redact.go.phpboyscout.uk

gitlab.com/phpboyscout/go/redact redacts credential-like content from free-form strings at the boundary between trusted and untrusted observability surfaces — telemetry vendors, log aggregators, metric stores. Error messages, command arguments, and HTTP header values routinely carry secrets by accident (a URL with embedded userinfo, an flag in , an header quoted in an export error). Route those through on the way out and they never leave the process in the clear.

--api-key=sk-…
os.Args
Authorization
redact.String

Design

  • Zero dependencies. Pure standard library (regexp, strings) — nothing but the module enters your graph. A depfootprint_test.go guard enforces it.
  • Boundary redaction. Sanitise where data leaves the host, not everywhere.
  • Conservative by default. The opaque-token fallback requires ≥41 chars so it never false-positives on UUIDs, MD5, or SHA-1.

Install

root@kitploit:~
go get gitlab.com/phpboyscout/go/redact

Usage

root@kitploit:~
import "gitlab.com/phpboyscout/go/redact"

safe := redact.String("failed calling https://user:[email protected]?api_key=sk-abc123…")
// → credentials in the URL userinfo, the api_key query param, and the sk- token are masked

msg := redact.Error(err) // redact.String applied to err.Error() (nil-safe)

if redact.IsSensitiveHeaderKey("Authorization") { /* … redact this header's value … */ }

redact.String strips URL userinfo for any scheme (https://, postgres://, redis://, …), credential name=value assignments, JSON credential fields such as "access_token" and "client_secret", Authorization-header tokens, JWTs, well-known provider prefixes (sk-, ghp_, glpat-, AIza, AKIA, Slack), and long opaque tokens. SensitiveHeaderKeys / IsSensitiveHeaderKey identify headers whose values should be redacted.

Limitations

Pattern catalogues never reach 100% recall, and this one is deliberately conservative:

  • No configuration. You cannot add, disable or reorder a pattern — the package exports four symbols and nothing to tune. Compose around it instead.
  • String does not mask arbitrary header values. It knows Authorization: and nothing else; X-API-Key: … passes through. That is what the header symbols are for.
  • Bespoke and short secrets slip through. The catch-all fallback needs 41 characters, and each provider prefix has a hard minimum length.
  • Patterns are ASCII-only, and redaction is one-way — nothing to reverse and no record of what was replaced.

What redact does not do states the full boundary.

Documentation

Full guides, reference and threat model: redact.go.phpboyscout.uk. Generated API docs and runnable examples: pkg.go.dev.

License

See LICENSE.

Download Tool