rlg-redact 0.0.11

PII and secret redaction for rlg records. Built-in regex patterns for credit cards, JWTs, OAuth bearers, emails, and IPv4 addresses, plus a custom-pattern API. Sits between `Log::fire()` and the sink so logs emitted to disk / OTLP / syslog are scrubbed.
Documentation

Install

[dependencies]
rlg-redact = "0.0.11"

Requires Rust 1.88.0 or newer (edition 2024).

Usage

use rlg::log::Log;
use rlg_redact::Redactor;

let redactor = Redactor::with_defaults();

let log = Log::info("card 4111-1111-1111-1111 declined")
    .with("email", "user@example.com")
    .with("client_ip", "10.0.1.42");

let safe = redactor.scrub(log);
//   description: "card [REDACTED] declined"
//   email:       "[REDACTED]"
//   client_ip:   "[REDACTED]"
safe.fire();

Built-in patterns

Constant Matches
CREDIT_CARD 13–19-digit PANs (Visa, MC, Amex, Discover) with optional spaces/hyphens
JWT three-segment base64url JWTs
BEARER_TOKEN Authorization: Bearer <token> headers
EMAIL RFC 5321 addresses (good-enough subset)
IPV4 dotted-quad IPv4 addresses
AWS_ACCESS_KEY AWS key IDs (AKIA / ASIA / AGPA / ANPA / ANVA / AROA / AIPA)

Redactor::with_defaults() loads all six. Build a minimal redactor with Redactor::empty() and add patterns one at a time with .with_pattern(...).

Custom patterns

use rlg_redact::Redactor;

let redactor = Redactor::with_defaults()
    .with_pattern(r"(?i)password=\S+")?
    .with_pattern(r"\bsk_live_[A-Za-z0-9]{24}\b")?     // Stripe live keys
    .marker("***");

What gets scrubbed

  • Log::description
  • Every string attribute value
  • String values inside JSON arrays + objects (recursive)

Non-string attributes (u64, i64, bool, f64) are passed through unchanged — numeric IDs are not redacted.

License

Dual-licensed under Apache 2.0 or MIT, at your option.