redact-secrets

Scrub secrets from text and objects: AWS keys, GitHub tokens, JWTs, PEM blocks, bearer headers, hex/base64 keys.

What & Why

Detect and redact common secret patterns before logging or sharing text. Key-name based redaction for objects. Report mode lists what was found without exposing values. Documented: NOT a security boundary, helps with log hygiene.

API

export function redact(text: string, config?: RedactConfig): string
export function redactObject(obj: unknown, config?: RedactConfig): unknown
export function report(text: string, config?: RedactConfig): Record<string, number>

Install

npm install @ferrow/redact-secrets

Quick Start

import { redact, redactObject, report } from 'redact-secrets';

const text = 'User key: AKIA1234567890123456 and token: ghp_xxx';
console.log(redact(text)); // 'User key: [REDACTED] and token: [REDACTED]'

const findings = report(text);
console.log(findings); // { 'aws-key': 1, 'github-token-ghp': 1 }

const obj = { username: 'alice', password: 'secret123' };
console.log(redactObject(obj)); // { username: 'alice', password: '[REDACTED]' }

Limits

• Regex-based; no cryptographic guarantee secrets are found.
• High false-positive rate on hex/base64 patterns; review results.
• NOT a security boundary; do not rely for compliance or when actual security is required.

---

Part of the ferrow-toolkit collection · Sponsored by Ferrow