rtb-redact

Part of the phpboyscout Rust toolkit: small, framework-free crates extracted from rust-tool-base.

Free-form secret redaction for log lines, telemetry events, and diagnostic surfaces. Strips URL userinfo, credential query parameters, Bearer/Basic/Token credentials, PEM private-key blocks, JWTs, well-known provider key prefixes, and long opaque tokens. The rules run in a fixed order and err toward over-redaction.

use rtb_redact::string;

let scrubbed = string("connect to postgres://app:hunter2@db/mydb");
assert!(scrubbed.contains("[redacted]"));
assert!(!scrubbed.contains("hunter2"));

What it does not do

It matches shapes, not values, so it catches only what it has been taught. JSON and YAML are not parsed (password=x redacts, "password": "x" does not), header values need an explicit call, secrets below the thresholds slip through, and a bare git commit hash is 40 characters and gets redacted. The full list is in What rtb-redact does not do.

Documentation

• Tutorial: Scrub your first log line
• Reference: API · Redaction rules
• Docs site: https://redact.rust.phpboyscout.uk
• Rustdoc: https://docs.rs/rtb-redact
• Crate: https://crates.io/crates/rtb-redact

Development

just ci runs the full local gate (fmt, clippy, nextest, doc, deny). Tests include a cucumber BDD suite (tests/bdd.rs). Releases are cut by colophon from Conventional Commits, so do not tag manually.

License

MIT