Module privacy 

Constants

PRIVATE_REDACTION

SECRET_REDACTION_PLACEHOLDER

Marker substituted in place of every redacted secret by redact_secrets. Kept byte-for-byte identical to the cloud’s SECRET_REDACTION_PLACEHOLDER (redact-secrets.ts) so a rule that round-trips through either side reads the same.

Functions

redact_secretish_tokens

redact_secrets

Conservative pre-persist secret redaction for locally-drafted rule text.

strip_private_tagged_regions