rtb-redact 0.6.1

---
title: rtb-redact
description: Free-form secret redaction for logs, telemetry events, and diagnostic surfaces.
---

# `rtb-redact`

Strips secrets out of free-form strings before they reach telemetry,
distributed logs, or any third-party observability surface. The rule set
runs in a fixed order and is deliberately conservative — it errs toward
over-redaction.

Part of the [phpboyscout Rust toolkit](https://rust.phpboyscout.uk);
extracted from — and battle-tested by —
[rust-tool-base](https://gitlab.com/phpboyscout/rust-tool-base).

## Public API

```rust
use rtb_redact::string;

let scrubbed = string("connect to postgres://app:hunter2@db/mydb");
assert!(scrubbed.contains("[redacted]"));
assert!(!scrubbed.contains("hunter2"));
```

| Item | Purpose |
|---|---|
| `string` | Redact a `&str`, returning `Cow` — `Borrowed` when nothing matched (no allocation on the common case), `Owned` otherwise. |
| `string_into` | Same rules, appending into a caller-supplied `String` to reuse a buffer. |
| `SENSITIVE_HEADERS` | `phf::Set` of header names whose values must be redacted at DEBUG/TRACE. O(1) lookup. |
| `is_sensitive_header` | Case-insensitive membership test against `SENSITIVE_HEADERS`. |
| `redact_header_value` | Redact a single header value. |

Full API reference: [docs.rs/rtb-redact](https://docs.rs/rtb-redact).

## What gets redacted

`string` strips URL userinfo, common credential query parameters,
`Authorization` headers, well-known provider prefixes (`sk-`, `ghp_`,
`AIza`, `AKIA`, Slack tokens, Anthropic `sk-ant-…`), and very long opaque
tokens. A fast pre-check bails out before allocating when no anchor
character or keyword is present, so the hot path on clean strings is
cheap.

## Where it's wired

- `rtb-telemetry` applies `string` automatically to `args` and `err_msg`
  on every event.
- `SENSITIVE_HEADERS` enumerates the headers to redact at DEBUG and is
  available for an HTTP-client middleware to apply — until a shared
  client middleware exists in the framework, redact headers at the call
  site.
- Any code emitting free-form strings to an external surface should
  route through `string` first — see the
  [how-to](how-to/redact-before-an-external-surface.md).

This crate complements `secrecy::SecretString` (which prevents *typed*
secrets from being formatted): `rtb-redact` is the safety net for strings
that were *assembled* and might contain a secret no type system caught.

## Design record

The authoritative contract (including the full ordered rule set) is the
crate's v0.1 spec, retained in the rust-tool-base
[spec series](https://gitlab.com/phpboyscout/rust-tool-base/-/blob/main/docs/development/specs/2026-04-23-rtb-redact-v0.1.md).