Crate trace_redact 

trace-redact

Walk a serde_json::Value (agent trace, OTel span attributes) and redact sensitive values in place. Two layers of detection:

1. Key-name match — fields named api_key, token, authorization, password, etc., are replaced regardless of value shape.
2. Value-pattern match — string values that look like API keys, bearer tokens, emails, phone numbers, or SSNs are replaced.

Example

use trace_redact::redact;
use serde_json::{json, Value};

let mut v: Value = json!({
    "model": "claude-sonnet-4-5",
    "headers": { "authorization": "Bearer sk-live-AAAABBBBCCCCDDDD" },
    "user_email": "jane@example.com",
});
redact(&mut v);
assert_eq!(v["headers"]["authorization"], json!("[REDACTED]"));

Constants

REPLACEMENT

Replacement token written into redacted slots.

Functions

looks_sensitive

True for strings that pattern-match an API key, bearer token, email, phone, or SSN.

redact

Walk v and redact in place.