Crate veloci 

veloci

Veloci Redactor (veloci) is a Rust library for redacting secrets and personal data from text and structured files. It was previously published as velociredactor.

Each redacted value becomes a token named [REDACTED-N]. N numbers distinct secrets in order of first appearance, and equal values share a number. The token format is configurable: {n} is that number and {reason} is the detector that found the secret. Exact values and regular expressions can allow confirmed false positives.

Structured format support preserves keys and formatting while replacing values. Comment scanning is configurable. Raw mode treats the complete input as plain text.

The CLI README covers the command-line program, installation, and command reference.

Quick start

Add the crate to a project:

[dependencies]
veloci = "0.1"

The default builder includes the built-in configuration:

use veloci::{Allow, FormatHint, Redactor};

let redactor = Redactor::builder().build();
let input = br#"{"db_password": "hunter2", "note": "hello"}"#;

let redaction = redactor.redact(input, FormatHint::Name("json")).unwrap();
assert_eq!(redaction.findings()[0].id, 1);
assert_eq!(redaction.findings()[0].token(), "[REDACTED-1]");

let output = redaction.render(&Allow::none()).unwrap();
assert_eq!(
    output,
    br#"{"db_password": "[REDACTED-1]", "note": "hello"}"#
);

// Render the same findings again while allowing that value through.
assert_eq!(redaction.render(&Allow::values(["hunter2"])).unwrap(), input);

Redactor::redact separates detection from rendering. A Redaction can render the same findings repeatedly with different Allow lists. Redactor::redact_str provides a compact plain-text API that replaces every finding.

Configuration

Configuration defines the values to scan, documentation placeholders, active detectors, recognized formats, and allowed findings.

config::Config represents the complete configuration. Config::builtin returns the copy compiled into the crate. Config::builtin_source returns its commented YAML source. Config::apply applies a configuration to a RedactorBuilder.

A configuration loaded from a file replaces the built-in configuration completely. Start a custom configuration from Config::builtin_source.

RedactorBuilder::new creates an empty builder. Redactor::builder creates a builder with the built-in detectors, formats, and policy. RedactorBuilder::replacement sets the token format; ReplacementFormat parses a string with {n} and {reason}.

Formats

Default features provide structured handling for:

• JSON and JSON Lines
• YAML
• TOML
• XML
• HCL
• INI and dotenv files
• Java properties
• CSV, TSV, and pipe-separated values
• binary property lists
• plain text

FormatHint chooses a format by name, path, content, or raw text. An inferred structured format that fails to parse falls back to plain text and records a warning. An explicitly named format returns its parse error.

Cargo features

The default feature set enables parallel detection and every bundled structured format.

• parallel uses Rayon for detector execution.
• json, yaml, toml, xml, hcl, ini, dotenv, properties, csv, and plist enable their corresponding formats.
• privacy-filter enables the OpenAI Privacy Filter model detector.
• privacy-filter-cuda enables NVIDIA CUDA execution.
• privacy-filter-accelerate enables Apple Accelerate.
• privacy-filter-openblas enables a system OpenBLAS installation.

Choose one BLAS backend feature for a build. The privacy-filter model is downloaded separately.

Extending

Implement detect::Detector to add detection logic and register it with RedactorBuilder::detector. Bundled detectors such as detect::BETTERLEAKS_RULESET and detect::EmailDetector use the same interface. A detector that needs every document value together uses detect::Detector::document_scope.

Implement format::Format to add a file format and register it with RedactorBuilder::format. The format::LeafVisitor interface communicates values and replacements while the format owns parsing and serialization.

Implement policy::LeafPolicy to control which structured values are scanned and which objects provide credential context.

The repository includes a complete custom detector and format in examples/custom.rs.

License

Veloci Redactor is available under the MIT License.

Modules

agent

Files an AI coding agent must read through Veloci Redactor.

config

The configuration: everything Veloci Redactor knows, as data.

detect

Secret and PII detectors.

files

Sets of files named by .gitignore-style patterns.

format

Input formats.

policy

Rules for which values in structured data are scanned at all.

Structs

Allow

Secrets to leave in place, identified by exact value or by a pattern the whole value matches.

Finding

One redacted secret. Every occurrence of the same text shares a finding.

FormatError

A format failed to parse or re-serialize its input.

Glob

A glob pattern.

Redaction

The result of scanning an input: identified secrets, ready to render.

Redactor

Finds and redacts secrets. Build one with Redactor::builder.

RedactorBuilder

Configures a Redactor.

ReplacementFormat

How a redacted secret is written back: a format string with {n} and {reason} as replacement values.

Enums

Error

Errors returned while building a Redactor or redacting input.

FormatHint

How to choose the format of an input.

Constants

DEFAULT_REPLACEMENT

The built-in replacement template: [REDACTED-{n}].

Functions

find_tokens

Byte ranges of the replacement tokens in s under format.

is_redaction_token

Whether s is exactly a replacement token under format.

token

Format a replacement token using format.