1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
# config.example.yaml: policy, learned secrets and the heuristic.
# Copy to ~/.config/redacted/config.yaml (global) or .redacted.yaml (project root).
# Patterns and allow_values go in engine.yml.
# Set to 2 by `redacted init`. A global file without it is a 0.7 config:
# no learned secrets, and the hook asks you to run `redacted init`.
version: 2
# Written by `redacted init`. Read from the global file only.
# Each entry: the value's sha256, its byte length and, for values with a literal
# prefix, a shape regex that also catches rotated keys. Never the value.
learned:
- name: acme_api_key
sha256: 0000000000000000000000000000000000000000000000000000000000000000
len: 29
shape: '\bacme_[a-zA-Z0-9]{20,28}\b'
# Opt-in entropy tier for KEY=value pairs. Read from the global file only.
# An absent threshold takes the default shown; an explicit value, 0 included,
# is used as written.
heuristic:
enabled: false
min_length: 16 # value has at least this many characters
max_length: 128 # value has at most this many characters
min_char_classes: 3 # of lowercase, uppercase, digit
min_entropy: 3.5 # Shannon entropy, bits per character
# Opt-in PII tier: email addresses and phone numbers. Read from the global file only.
# An absent toggle is off. Keep your own address visible with allow_values in engine.yml.
pii:
email: false
phone: false
# Turn off vendor or engine.yml patterns by name (see the README table).
# No effect on learned secrets or the heuristic.
whitelist:
- jwt
- stripe_test
# Skip a vendor or heuristic match whose text contains one of these names
# (case-insensitive). Only keyed matches (KEY=value) contain the name, so
# value-only patterns and learned secrets ignore this list.
allow:
- APP_URL
- TWILIO_WORKFLOW_SID
# Scrub Bash output only; Read, Grep, WebFetch and other tools pass through.
ignore_internal_tools: false
# In a project file: drop the global file instead of merging.
# version, learned, heuristic and pii still come from the global file.
override: false