# rtb-redact
> Part of the [phpboyscout Rust toolkit](https://rust.phpboyscout.uk):
> small, framework-free crates extracted from
> [rust-tool-base](https://gitlab.com/phpboyscout/rust-tool-base).
Free-form secret redaction for log lines, telemetry events, and
diagnostic surfaces. Strips URL userinfo, credential query parameters,
`Bearer`/`Basic`/`Token` credentials, PEM private-key blocks, JWTs,
well-known provider key prefixes, and long opaque tokens. The rules run
in a fixed order and err toward over-redaction.
```rust
use rtb_redact::string;
let scrubbed = string("connect to postgres://app:hunter2@db/mydb");
assert!(scrubbed.contains("[redacted]"));
assert!(!scrubbed.contains("hunter2"));
```
## What it does not do
It matches shapes, not values, so it catches only what it has been taught.
JSON and YAML are not parsed (`password=x` redacts, `"password": "x"` does
not), header values need an explicit call, secrets below the thresholds
slip through, and a bare git commit hash is 40 characters and gets
redacted. The full list is in
[What rtb-redact does not do](https://redact.rust.phpboyscout.uk/explanation/what-rtb-redact-does-not-do/).
## Documentation
- **Tutorial:** [Scrub your first log line](https://redact.rust.phpboyscout.uk/tutorials/scrub-your-first-log-line/)
- **Reference:** [API](https://redact.rust.phpboyscout.uk/reference/api/) ยท
[Redaction rules](https://redact.rust.phpboyscout.uk/reference/rules/)
- **Docs site:** <https://redact.rust.phpboyscout.uk>
- **Rustdoc:** <https://docs.rs/rtb-redact>
- **Crate:** <https://crates.io/crates/rtb-redact>
## Development
`just ci` runs the full local gate (fmt, clippy, nextest, doc, deny).
Tests include a cucumber BDD suite (`tests/bdd.rs`). Releases are cut by
colophon from Conventional Commits, so do not tag manually.
## License
MIT