trace-redact 0.1.0

Redact sensitive fields (api keys, tokens, emails, phone numbers) from agent traces before exporting to OTel or a log sink. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

use serde_json::json;
use trace_redact::{redact, REPLACEMENT};

#[test]
fn redacts_known_key_names() {
    let mut v = json!({
        "api_key": "anything",
        "authorization": "Bearer x",
        "Password": "y",
        "innocent": "z",
    });
    redact(&mut v);
    assert_eq!(v["api_key"], json!(REPLACEMENT));
    assert_eq!(v["authorization"], json!(REPLACEMENT));
    assert_eq!(v["Password"], json!(REPLACEMENT));
    assert_eq!(v["innocent"], json!("z"));
}

#[test]
fn redacts_api_key_pattern_in_value() {
    let mut v = json!({ "note": "sk-live-AAAABBBBCCCCDDDD" });
    redact(&mut v);
    assert_eq!(v["note"], json!(REPLACEMENT));
}

#[test]
fn redacts_emails_and_ssns() {
    let mut v = json!({
        "email": "jane@example.com",
        "ssn": "123-45-6789",
    });
    redact(&mut v);
    assert_eq!(v["email"], json!(REPLACEMENT));
    assert_eq!(v["ssn"], json!(REPLACEMENT));
}

#[test]
fn descends_nested_objects_and_arrays() {
    let mut v = json!({
        "spans": [
            { "headers": { "Authorization": "Bearer x" } },
            { "ok": true }
        ]
    });
    redact(&mut v);
    assert_eq!(v["spans"][0]["headers"]["Authorization"], json!(REPLACEMENT));
}

#[test]
fn leaves_safe_strings_alone() {
    let mut v = json!({ "model": "claude-sonnet-4-5" });
    redact(&mut v);
    assert_eq!(v["model"], json!("claude-sonnet-4-5"));
}