Secrets Redactor

A secrets redactor scans pasted text for common secret patterns, API keys, authentication tokens, private keys, connection strings, and passwords embedded in configuration files, environment variables, or source code, and replaces every match according to a selected redaction mode before the text is shared or copied elsewhere.

Three redaction modes are available. Mask preserves a small number of leading characters and replaces the remainder with asterisks, which identifies which credential was redacted without exposing a usable value; the number of leading characters preserved defaults to 4, enough to recognize a key type such as AKIA for an AWS access key or ghp_ for a GitHub token, without revealing enough of the value to use it. Replace with custom text substitutes the entire secret with a chosen string, such as REDACTED or [REMOVED]. Remove secrets entirely deletes a matched secret with no placeholder left behind.

The built-in pattern library detects AWS access and secret keys; GitHub personal access tokens by their ghp_, gho_, ghu_, ghs_, ghr_, and github_pat_ prefixes; GitHub OAuth and App client secrets written next to a client_secret key; Slack tokens by their xoxb-, xoxp-, and xoxa- prefixes; JSON Web Tokens in their three-segment Base64 format; PEM-encoded private key blocks; Bearer authorization headers; database connection strings with an embedded password; and a generic assignment where a variable named key, token, secret, password, or api_key is set to a long alphanumeric or Base64 value.

Custom regex patterns, one per line, extend detection to a proprietary key format the built-in library does not recognize, and high-entropy string detection and URL credential detection can each be switched on or off depending on the content being scanned. A dedicated paste control reads the clipboard directly and redacts its contents in one step; a browser that blocks clipboard reads, including Firefox and any page opened directly from disk, prompts for a manual paste with Ctrl+V or Command+V instead. A count of detected secrets displays above the redacted output, and detection re-runs automatically a moment after typing stops, so the count and the redacted text stay in sync with whatever was pasted most recently rather than reflecting an earlier version of it.

Redacting secrets from text is a routine step in secure development workflows, incident response, and day-to-day collaboration. The following scenarios illustrate where automatic credential scanning prevents accidental exposure.

• LLM Context Sharing: Configuration files, deployment scripts, or error logs run through the redactor before being sent to a large language model, so the model receives full structural context for debugging or code review without access to live credentials, reducing the risk of secret leakage through third-party AI services.
• Code Review and Pull Requests: Sanitize log output, stack traces, or environment dumps before including them in pull request descriptions or code review comments. Reviewers see the relevant context while credentials remain masked or removed.
• Incident Response Documentation: During a security incident, responders often need to share configuration snapshots, access logs, or credential rotation evidence across teams and ticketing systems. Run the text through the redactor so that the documentation captures the structure and timeline without embedding live secrets in permanent records.
• DevOps Pipeline Debugging: CI/CD logs frequently contain injected environment variables, API tokens passed as build arguments, or connection strings printed during setup steps. Redact the raw log output before pasting it into a support ticket or team channel to prevent credential exposure outside the operations team.
• Onboarding and Training Materials: Create realistic configuration examples from production files by masking actual credentials while preserving the file structure, key names, and formatting. New team members see exactly how the configuration looks in practice without gaining access to live systems.
• Compliance and Audit Preparation: Generate sanitized copies of deployment configurations, scripts, and environment files for compliance auditors who need to verify infrastructure patterns without receiving actual access credentials. Partial masking (showing the first four characters) lets auditors confirm key types and rotation status.
• Open Source Contributions: Strip credentials from configuration templates, issue reproductions, or example code before publishing to public repositories. The redactor catches secrets that manual review might miss, especially in large multi-file pastes or long terminal session outputs.

Pattern matching finds secrets that look like secrets. Read the list below before treating any output as safe to publish, and check the result directly when the text matters.

• Plain hex and number strings need a label. A GitHub client secret is 40 hexadecimal characters, and so is a git commit SHA. Nothing in the characters themselves tells the two apart. The redactor therefore hides a 40-character hex value only when a nearby key names it, such as client_secret, clientSecret, or GITHUB_CLIENT_SECRET. A client secret pasted on its own with no label stays visible, which is the trade that keeps commit history readable.
• Short or shortened values slip through. The token rules expect full length, such as 36 characters after a ghp_ prefix. A truncated token in a code sample or a shortened example in documentation falls below that bar and is left alone.
• Unusual key names are missed. Generic detection keys off common names including key, token, secret, password, api_key, and credential. A value stored under a name such as blorp_value is not recognized. A custom expression in Settings under Custom Patterns covers a case like that.
• New and private credential formats are not known in advance. The library covers widely used providers. A vendor that invents a format, or an internal system with its own scheme, needs a custom pattern.
• Secrets split across lines stay hidden from the scanner. A value broken over several lines by string concatenation or line wrapping does not read as one string, so it is not matched. The exception is a PEM private key block, which is detected from its BEGIN and END markers.
• Masking preserves length and prefix by design. Mask mode leaves the leading characters and shows one asterisk per remaining character. That reveals how long the secret was and what type it was. Replace or Remove suits a case where even that much should not leave the machine it was typed on.

Treat the result as a strong first pass rather than a guarantee. Rotate any credential that has already been pasted somewhere it should not have been, because redacting a copy does not undo the original exposure.