Skip to main content

Module secrets

Module secrets 

Source
Expand description

Canonical secret-token and path prefixes shared by redaction layers across crates.

zeph-core::redact and zeph-memory::store::compression_guidelines both scrub secrets and filesystem paths before persisting or displaying untrusted text. Each crate previously carried its own hand-rolled copy of these lists, and the copies had already begun to drift from each other (see #5917). This module is the single source of truth for the raw prefixes/patterns; consumers compile their own regex::Regex instances from these constants — zeph-common does not depend on regex outside of tests, matching the pattern established by crate::patterns.

Constants§

BEARER_TOKEN_PATTERN
Regex pattern matching Authorization: Bearer <token> headers.
JWT_PATTERN
Regex pattern matching standalone JWTs (three Base64url-encoded segments separated by dots).
PATH_PREFIXES
Absolute filesystem path prefixes redacted before persisting or displaying untrusted text, to avoid leaking local usernames or directory layout.
SECRET_PREFIXES
Prefixes of API keys, tokens, and other secret material recognized across Zeph.