Runtime credential redaction · Open source
A credential pasted into a prompt can end up in a tool response, a trace, a log, and a conversation history. Redact Secret detects supported credentials while the data is still in your application and replaces them before they reach those destinations.
One local detection core. Integrations for the paths your data takes.
Synthetic fixture, not a live credential. The finding metadata records the family, offset, and length of the match, never the value.
The runtime problem
Repository scanners help find secrets committed to code. Redact Secret works where your application handles text at runtime: user input, error messages, tool results, logs, traces, stored records, and model context. One paste becomes five copies before anyone notices.
A user pastes one line
API_KEY=
The application never asked for a credential. It arrived inside text the application does not control.
Rotating the credential is the only remedy once it has landed. The scan belongs one step earlier, at the boundary where your application hands the text to something else.
Playground
Edit the input and watch the output change. The detection core runs as WebAssembly in this tab, the same engine the packages ship.
Nothing you type leaves this browser tab. It is not sent, stored, or logged, and spellcheck is off. Use synthetic values anyway: never paste a live credential into a web page.
PII detection is opt-in and off by default: credentials only. Global adds email, phone, payment card, IP address, and IBAN; Global + US adds US Social Security numbers. Each mode is a separate engine instance, because the core fixes its PII selection when it starts.
Loading the engine…
First run
Install a specific published version, run one scan, and compare the output. The same synthetic fixture is used in every runtime.
npm install @redact-secret/core@0.1.0-beta.13import { initialize, scanAndRedact } from "@redact-secret/core";
await initialize();
const result = scanAndRedact("API_KEY=SYNTHETIC_REVOKED_CONTEXT_VALUE");
console.log(result.text);
// API_KEY=<SECRET_1>python -m pip install redact-secret==0.1.0b13import redact_secret
result = redact_secret.scan_and_redact("API_KEY=SYNTHETIC_REVOKED_CONTEXT_VALUE")
print(result.text)
# API_KEY=<SECRET_1>cargo install redact-secret-cli --version 0.1.0-beta.13 --lockedprintf '%s\n' 'API_KEY=SYNTHETIC_REVOKED_CONTEXT_VALUE' \
| redact-secret --redact
# API_KEY=<SECRET_1>Rust is installed from crates.io; its first example lives in the Rust guide.
latest points at it today. The command pins it anyway, because latest has moved before. Python spells it 0.1.0b13.Package state comes from one place, the release record, read at build time and shown with the date it was checked. It is never retyped into translated prose.
The value is gone and a typed placeholder stands in its place. result.findings describes the family, offset, and length, and carries no plaintext.
How it works · Control
Detection and redaction run locally, without sending text to a scanning service. No network calls, no telemetry, and the same input always gives the same result.
A scan in the client catches a pasted credential before it leaves the device. Clients can be modified or skipped, so this scan helps but never enforces anything.
The server scans again, independently, before logging, storage, context construction, or model and tool invocation. That scan is the one your security decisions rely on.
blockThe core reports a block action. Your application is what rejects the request. Redact Secret does not stop anything on its own.
The architecture, page by pageRead the architectureSafe integration guide
Core, adapters, and vault
One Rust detection core sits behind every package. Adapters wire it into logging, tracing, and AI workflows, so no host has to recreate the detection rules. The vault is a separate, opt-in way to restore what was redacted. Each card states what that package does not cover.
One engine, three ways in.
@redact-secret/core (npm)
Detection, policy, and redaction in Rust, with one API for JavaScript (Node.js and browsers), Python, and Rust.
Credentials by default. PII detection is opt-in and off unless you select it.
@redact-secret/wasm (npm)
The browser build of the core. Installed automatically with @redact-secret/core; not meant to be imported directly.
Runs on the page or in a Worker. The playground above uses it.
redact-secret-cli (crates.io)
Reads standard input or one file and writes the sanitized text, for shells, pipelines, and hooks.
Installed from crates.io, not npm. PII is opt-in with --pii.
Host integrations. They make no decisions of their own: they pass text to the core and hand its answer back.
Browser
@redact-secret/core/web-stream (npm)
A TransformStream that redacts text as it streams, shipped inside the core.
There is no separate browser adapter package; this core subpath is the browser integration.
Node.js
@redact-secret/adapter-pino (npm)
Redacts values in log calls and in the finished line, alongside pino’s own path-based redact.
Not object keys, and nothing a destination or transport adds after the line is written.
@redact-secret/adapter-otel-trace (npm)
A dedicated OpenTelemetry trace adapter wraps the next SpanProcessor and redacts span names, attributes, events, links, and status messages.
Attribute names are not redacted; spans the wrapped processor never receives are out of reach.
@redact-secret/adapter (npm)
createMaskSecrets() for hosts that hand you a value to mask, such as Langfuse.
Covers only what the host routes through its callback.
@redact-secret/adapter-ai-context (npm)
Builds model context from user input and tool results. Fail-closed and all-or-nothing.
Binary and encoded values are blocked, not decoded. Model output is not covered.
@redact-secret/adapter-mcp (npm)
Scans MCP tools/call and resources/read results before they are logged, stored, or placed in context.
Other MCP methods are out of scope; binary payloads block the result by default.
Python
redact-secret-adapters (PyPI)
A logging.Filter that adds value-based redaction to the standard library.
Runs only where attached, so put it on every emitting handler rather than on the logger.
redact-secret-adapters[otel] (PyPI)
Wraps the next OpenTelemetry span processor in Python services.
Installed only with the otel extra. A span that cannot be rewritten is dropped, not exported.
redact-secret-adapters (PyPI)
mask_secrets for hosts that hand you a value to mask, such as Langfuse.
Covers only what the host routes through its callback.
Optional and separate. The core never keeps a value; the vault holds a mapping in memory only when you ask it to, and restores only under your policy.
Browser
@redact-secret/vault (npm)
Replaces a secret with an opaque <rsv_…> token on the way to a model, and restores it only into a field you designate.
Main thread, or an opt-in dedicated-Worker mode qualified separately. No storage, no network.
Node.js
@redact-secret/vault (npm)
The same in-memory capture and restore in Node.js 20, 22, and 24.
Pins one exact core version; it does not install beside a different one.
@redact-secret/vault-server (npm)
Authorizes every restore by principal, tenant, source, destination, and value path.
In-memory is beta. The opt-in persistent profile is alpha and qualified only for its documented PostgreSQL profiles.
Python
redact-secret-vault (PyPI)
A native Python implementation of the vault server’s authorization contract.
Research-grade on PyPI. Capture needs Node.js; persistent extras are published but not supported.
Versions, tags, and ranges as published on the registries, observed 2026-10-03.
Public evidence
Explore supported credential formats, their evidence status, and reproducible benchmark results. The benchmark site publishes its methods and limitations alongside the numbers.
Which credential families are supported and how strong the evidence is for each. Generated from evaluation evidence, not written by hand.
Support matrix →Every published version with its source revision, artifact set, and registry state, including the runs that did not complete.
Release record →Project-maintained synthetic measurements with fixture provenance, tool versions, and stated limits. Reproducible regression evidence, not a product ranking.
Read the methods, then the numbers ↗| The problem | Where to start |
|---|---|
| Find credentials already committed to Git history | Gitleaks or TruffleHog |
| De-identify broad personal data in documents and images | Presidio or a managed data-protection service |
| Replace supported credentials in a running application before they reach logs, traces, tools or AI context | Redact Secret |
These tools solve different problems and complement each other. The table points you to a starting place; it does not score them.
Next step
Start with the core. Add the integration that fits your logs, traces, or AI workflow.