[
{
"name": "flat secret",
"input": {
"api_key_secret": "sk-1234567890",
"name": "test"
},
"expected": {
"api_key_secret": "***",
"name": "test"
}
},
{
"name": "nested secret",
"input": {
"storage": {
"postgres_url_secret": "postgres://user:pass@host/db"
}
},
"expected": {
"storage": {
"postgres_url_secret": "***"
}
}
},
{
"name": "redacts non-string scalar",
"input": {
"count_secret": 42
},
"expected": {
"count_secret": "***"
}
},
{
"name": "case insensitive",
"input": {
"DATABASE_URL_SECRET": "postgres://user:pass@host/db",
"name": "test"
},
"expected": {
"DATABASE_URL_SECRET": "***",
"name": "test"
}
},
{
"name": "array traversal",
"input": [
{
"api_key_secret": "sk-123",
"name": "a"
},
{
"token_secret": "tok-456"
}
],
"expected": [
{
"api_key_secret": "***",
"name": "a"
},
{
"token_secret": "***"
}
]
},
{
"name": "container secret redacts subtree",
"input": {
"db_secret": {
"password_secret": "real",
"host": "localhost"
},
"name": "test"
},
"expected": {
"db_secret": "***",
"name": "test"
}
},
{
"name": "url-suffixed field scrubbed on default path",
"input": {
"location_url": "https://h/r?access_secret=zzz&q=1",
"name": "test"
},
"expected": {
"location_url": "https://h/r?access_secret=***&q=1",
"name": "test"
}
},
{
"name": "url-suffixed field userinfo password scrubbed",
"input": {
"cache_url": "redis://app:s3cr3t@cache:6379/0"
},
"expected": {
"cache_url": "redis://app:***@cache:6379/0"
}
},
{
"name": "non-url-suffixed field is not scanned",
"input": {
"note": "https://h/?token_secret=abc"
},
"expected": {
"note": "https://h/?token_secret=abc"
}
},
{
"name": "secret array redacts subtree",
"input": {
"tokens_secret": [
{
"inner": "sk-array"
}
]
},
"expected": {
"tokens_secret": "***"
}
},
{
"name": "url-suffixed field trims before scrubbing",
"input": {
"database_url": "postgres://u:p@h/db "
},
"expected": {
"database_url": "postgres://u:***@h/db"
}
},
{
"name": "url-suffixed field with internal whitespace is redacted",
"input": {
"database_url": "postgres://u:p @h/db"
},
"expected": {
"database_url": "***"
}
},
{
"name": "url-suffixed schemeless credential string is redacted",
"input": {
"database_url": "user:hunter2@db.internal:5432/app"
},
"expected": {
"database_url": "***"
}
},
{
"name": "url-suffixed schemeless benign value passes through",
"input": {
"next_url": "/callback?page=2",
"name": "test"
},
"expected": {
"next_url": "/callback?page=2",
"name": "test"
}
}
]