Skip to main content

Crate leakguard

Crate leakguard 

Source
Expand description

leakguard – fast, zero-dependency redaction of secrets and PII from text.

leakguard finds and removes sensitive data from arbitrary strings and log lines. It has no dependencies, is #![no_std]-friendly (with alloc), and ships with a small, hand-written scanner for every detector (no regex engine).

Enable the parallel feature to use Redactor::find_parallel and Redactor::clean_parallel for large inputs. These APIs use scoped standard library threads and keep the crate dependency-free.

§Stability and SemVer

The 1.0.0 API, CLI, MSRV, and deprecation policy are documented in the Stability and SemVer section of the README.

§Built-in detectors

Enabled by Redactor::new:

  • Cloud & platform keys: AWS access keys, Google API keys, Azure storage connection strings.
  • Service tokens: GitHub (ghp_, github_pat_), Slack (xoxb-), Stripe (sk_live_), OpenAI (sk-, sk-proj-), Telegram, Discord, JWTs.
  • Credentials: PEM private-key blocks, user:pass@host URL credentials.
  • PII & financial: emails, credit-card numbers (Luhn-validated), IBANs (mod-97-validated), US SSNs, IPv4/IPv6 addresses, MAC addresses.

Opt-in (the most false-positive-prone; add with Redactor::with_detector): detectors::PhoneNumber and detectors::HighEntropy.

§Quick start

use leakguard::Redactor;

let s = Redactor::new(); // all default detectors enabled
let dirty = "Contact alice@example.com from 10.0.0.1";
let clean = s.clean(dirty);
assert_eq!(clean, "Contact [REDACTED:EMAIL] from [REDACTED:IPV4]");

§Choosing how things are masked

use leakguard::{Redactor, Mask};

// Replace every match with a fixed string.
let s = Redactor::new().mask(Mask::fixed("***"));
assert_eq!(s.clean("ip 10.0.0.1"), "ip ***");

// Keep the last 4 characters of each match.
let s = Redactor::new().mask(Mask::Partial { keep_last: 4, ch: '*' });
assert_eq!(s.clean("card 4111 1111 1111 1111"), "card ***************1111");

§Choosing what to look for

use leakguard::{Redactor, Kind};

// Only redact emails and credit cards.
let s = Redactor::only(&[Kind::Email, Kind::CreditCard]);
assert_eq!(s.clean("a@b.com 10.0.0.1"), "[REDACTED:EMAIL] 10.0.0.1");

§Inspecting matches without mutating

use leakguard::{Redactor, Kind};

let s = Redactor::new();
let matches = s.find("email a@b.com");
assert_eq!(matches.len(), 1);
assert_eq!(matches[0].kind, Kind::Email);
assert_eq!(matches[0].text("email a@b.com"), "a@b.com");

Re-exports§

pub use detectors::Detector;
pub use detectors::FnDetector;
pub use detectors::LiteralDetector;

Modules§

detectors
Built-in detectors.

Structs§

LocatedMatch
A Match together with its 1-indexed line number and UTF-8 character column in the input text.
Match
A single detected span of sensitive data within the input text.
RedactionStats
Statistics summarizing the sensitive matches found and redacted by a Redactor.
Redactor
The main entry point: configure detectors + a Mask, then clean.

Enums§

Kind
The category of sensitive data a detector matched.
Mask
How a matched span is rewritten in the cleaned output.