Redact Secrets

Why Redact Secrets?

Secrets accidentally logged can lead to:

• Data breaches — attackers search logs for credentials
• Compliance violations — PCI-DSS, HIPAA, GDPR require secret protection
• Lateral movement — one leaked key can compromise multiple systems

Common Secret Patterns

This snippet catches common patterns:

Extending the Pattern

Add more patterns for your specific needs:

// Add AWS, Stripe, GitHub patterns
/(?:api[_-]?key|secret|token|password|auth|bearer|aws[_-]?access|stripe[_-]?key|gh[op]_)/gi

Best Practices

Keep some characters visible

Showing the last 4 characters helps with debugging:

• sk_live_***...x789 — You can identify which key was used
• ************ — No way to tell keys apart

Redact before logging, not after

// GOOD: Redact first
logger.info(redactSecrets(requestBody));

// BAD: Secret already in log buffer
logger.info(requestBody);
redactFromLogs(); // Too late!

Consider structured logging

Instead of string replacement, use structured logging with known secret fields:

const sanitized = {
  ...request,
  headers: {
    ...request.headers,
    authorization: '[REDACTED]'
  }
};

What This Doesn't Catch

• Base64-encoded secrets without keywords
• Secrets in URLs: https://user:pass@host
• Custom header names: X-Custom-Auth: secret
• Secrets in JSON without labeled keys