Crate secret_mask 

secret-mask

Mask known secret patterns in log lines before they reach a sink.

Detects:

• sk-…, sk_live_…, sk_test_…, rk_live_… — Stripe-style / Anthropic-style API keys
• ghp_…, github_pat_… — GitHub PATs
• xoxb-…, xoxp-… — Slack tokens
• AKIA… + [A-Z0-9]{16} — AWS access key IDs
• JWTs (eyJ…<base64.base64.base64>) — generic

Each secret is replaced with the literal [REDACTED]. Bring the input bytes; get the masked string back.

Example

use secret_mask::mask;
let masked = mask("authorization: Bearer sk-live-AAAABBBBCCCCDDDD1234");
assert!(!masked.contains("sk-live-AAAABBBBCCCCDDDD1234"));
assert!(masked.contains("[REDACTED]"));

Constants

REPLACEMENT

Token written into the masked positions.

Functions

has_secret

True when s contains any secret pattern.

mask

Mask any secrets found in s.