redac---n
Hide secrets in what your coding agent sends to a model provider.
Agents read .env files, run kubectl get secret, paste CI logs and run curl with auth headers, and all of it ends
up in the context sent to the provider, any router in between, and your logs. redac---n finds the secrets in that
text and replaces them with placeholders, and leaves alone the commit SHAs, digests, IDs and code the agent needs to
keep working.
TypeScript, no dependencies, no Node-only APIs: it runs on Node 20+, Bun and in the browser.
npm install redac---n
import { Redactor } from "redac---n";
const redactor = new Redactor();
redactor.redact("DATABASE_URL=postgres://app:Hx7mQ2pL9vRt@db:5432/app\nSALT=k2Lm9Qx", { hint: { command: "cat .env" } }).text;
// DATABASE_URL=postgres://app:[REDACTED password #a794f2]@db:5432/app
// SALT=[REDACTED secret #48712e] ← the hint says this is a .env file; without it, a 7-character SALT would stay
redactor.redactValue(messages).value; // a whole Anthropic or OpenAI message list, before you send it
Try it in your browser: paste a tool's output, give the command or file it
came from, and see what would be sent. The library runs in the page, so nothing you paste leaves it.
How well it works
On a held-out set of realistic agent output (1,112 cases, never used for tuning), redac---n catches 92.6% of
secrets and destroys 2.9% of the values that look like secrets but aren't. The best combination of existing
scanners we found catches 70.6% and destroys 2.2%; all seven together catch 84.2% but destroy 28.6% of the
look-alikes.
| secrets caught | look-alikes destroyed |
|---|
| redac---n (default) | 92.6% | 2.9% |
redac---n, guessing: "off" | 90.5% | 0.9% |
| gitleaks + Betterleaks + Kingfisher | 70.6% | 2.2% |
| all seven scanners combined | 84.2% | 28.6% |
| CredSweeper, the best single scanner | 70.1% | 15.2% |
On ordinary text with almost no secrets in it (agent trajectories and repositories it never saw), it redacts less
than Betterleaks, CredSweeper, Nosey Parker and detect-secrets; the scanners that redact less catch 39–55% of
secrets. Each bar is split by what was redacted, every tool's redactions sorted by one rule
(eval/shapes.ts): most of what Betterleaks and Nosey Parker hide is ordinary words, most of what
CredSweeper hides is hex (hashes and IDs), most of what detect-secrets hides is other values such as base64 digests,
and about half of redac---n's is credential-shaped. It can also
do something they can't: told which command or file the text came from, it reads what cat .env printed as a secret
file, and knows that cat .env | wc -l printed only a number.
CredData is labelled lines from public repositories, sorted here into the same
kinds. The top row is its dev split, the repositories the fixes were made on; the bottom row is its test split, which
none of them saw. On the test split redac---n catches more than any other scanner but CredSweeper in every kind, and
hits fewer false values than the other six combined: 88% of credential-shaped secrets for 6.6% of the false values
there, against 75% and 14%. CredSweeper is drawn apart because CredData's lines come partly from it and its model is
trained on CredData's labels.
It isn't a guarantee: about one secret in fourteen still gets through, mostly short values with no name or format
next to them. See what it misses.
Scoring. A secret counts as caught only if no run of half its length (at least 8 characters) survives. A
look-alike counts as destroyed if it doesn't survive exactly. Ordinary text has almost no secrets, so every
redaction there counts as a false one.
Held-out sets were written blind, by agents that never saw the code, and scored before anyone looked at them.
Held-out 1 is scored only as totals, and its failures are never looked at. Each later set was scored once, blind,
and then became development data. Secrets caught / look-alikes destroyed at that blind scoring:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
