Skip to content

rtb-redact

Strips secrets out of free-form strings before they reach telemetry, distributed logs, or any third-party observability surface. The rule set runs in a fixed order and is deliberately conservative — it errs toward over-redaction.

Part of the phpboyscout Rust toolkit; extracted from — and battle-tested by — rust-tool-base.

Public API

use rtb_redact::string;

let scrubbed = string("connect to postgres://app:hunter2@db/mydb");
assert!(scrubbed.contains("[redacted]"));
assert!(!scrubbed.contains("hunter2"));
Item Purpose
string Redact a &str, returning Cow — Borrowed when nothing matched (no allocation on the common case), Owned otherwise.
string_into Same rules, appending into a caller-supplied String to reuse a buffer.
SENSITIVE_HEADERS phf::Set of header names whose values must be redacted at DEBUG/TRACE. O(1) lookup.
is_sensitive_header Case-insensitive membership test against SENSITIVE_HEADERS.
redact_header_value Redact a single header value.

Full API reference: docs.rs/rtb-redact.

What gets redacted

string strips URL userinfo, common credential query parameters, Authorization headers, well-known provider prefixes (sk-, ghp_, AIza, AKIA, Slack tokens, Anthropic sk-ant-…), and very long opaque tokens. A fast pre-check bails out before allocating when no anchor character or keyword is present, so the hot path on clean strings is cheap.

Where it's wired

  • rtb-telemetry applies string automatically to args and err_msg on every event.
  • SENSITIVE_HEADERS enumerates the headers to redact at DEBUG and is available for an HTTP-client middleware to apply — until a shared client middleware exists in the framework, redact headers at the call site.
  • Any code emitting free-form strings to an external surface should route through string first — see the how-to.

This crate complements secrecy::SecretString (which prevents typed secrets from being formatted): rtb-redact is the safety net for strings that were assembled and might contain a secret no type system caught.

Design record

The authoritative contract (including the full ordered rule set) is the crate's v0.1 spec, retained in the rust-tool-base spec series.