High-accuracy regex patterns and pre-commit guardrail rules ensuring API keys, JWT tokens, private SSH keys, and PII are redacted before prompt transmission.
Secrets, API Keys & PII Redaction Guardrail
Overview
Prevents accidental leakage of confidential credentials and Personally Identifiable Information (PII) into LLM prompts or log files.
High-Precision Regex Detection Patterns
| Secret Type | Regex Pattern |
| :--- | :--- |
| OpenAI API Key | sk-[a-zA-Z0-9]{20,48} |
| GitHub Token | (ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36,255} |
| AWS Access Key | AKIA[0-9A-Z]{16} |
| Generic Bearer JWT | eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,} |
| Private RSA Key | -----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- |
Automated Redaction Hook
export function redactSecrets(text: string): string {
return text
.replace(/sk-[a-zA-Z0-9]{20,48}/g, "[REDACTED_OPENAI_KEY]")
.replace(/(ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36,255}/g, "[REDACTED_GITHUB_TOKEN]")
.replace(/AKIA[0-9A-Z]{16}/g, "[REDACTED_AWS_KEY]")
.replace(/eyJ[a-zA-Z0-9_-]{10,}.[a-zA-Z0-9_-]{10,}.[a-zA-Z0-9_-]{10,}/g, "[REDACTED_JWT]");
}