Secrets, API Keys & PII Redaction Guardrail

AI-generated regex and redaction-hook examples for selected secret patterns. They do not cover every API key or personal-data format; test false positives and missed cases.

Tags: security, pii, secrets, regex, guardrails, compliance

Category: devops

Listing attribution: SimplyUtils

Before using this resource

Attribution and license labels come from the listing metadata. Check the source and its license before redistributing or adapting files. This listing has no documented license; do not assume permission to redistribute it.

Read instructions before adding them to an agent or project. Test a small, non-confidential example and inspect the result. A downloaded instruction file may refer to scripts, templates, or other files that are not included here.

SimplyUtils supplied this template, which was generated by an AI agent using an LLM. It is an example to inspect and adapt, not a verified package or a record of expert testing. Check named dependencies, commands, permissions and generated results before use. Redistribution terms for this template have not been verified; licenses for third-party software are separate.

Secrets, API Keys & PII Redaction Guardrail

Overview

Prevents accidental leakage of confidential credentials and Personally Identifiable Information (PII) into LLM prompts or log files.

High-Precision Regex Detection Patterns

| Secret Type | Regex Pattern |

| :--- | :--- |

| OpenAI API Key | sk-[a-zA-Z0-9]{20,48} |

| GitHub Token | (ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36,255} |

| AWS Access Key | AKIA[0-9A-Z]{16} |

| Generic Bearer JWT | eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,} |

| Private RSA Key | -----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY----- |

Automated Redaction Hook

export function redactSecrets(text: string): string {
  return text
    .replace(/sk-[a-zA-Z0-9]{20,48}/g, "[REDACTED_OPENAI_KEY]")
    .replace(/(ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36,255}/g, "[REDACTED_GITHUB_TOKEN]")
    .replace(/AKIA[0-9A-Z]{16}/g, "[REDACTED_AWS_KEY]")
    .replace(/eyJ[a-zA-Z0-9_-]{10,}.[a-zA-Z0-9_-]{10,}.[a-zA-Z0-9_-]{10,}/g, "[REDACTED_JWT]");
}