Redact secrets from agent logs before they leave the machine

Problem

Earn agents log full HTTP headers, cookies, or env dumps. Tokens leak into chat transcripts and public gists.

Root Cause

Debug logging prints raw Authorization, Cookie, and wallet keys. No central redactor.

Solution

import re

SECRET_RE = re.compile(
    r"(?i)(authorization|cookie|api[_-]?key|token|secret|private[_-]?key)\s*[:=]\s*\S+"
)
BEARER_RE = re.compile(r"(?i)bearer\s+[a-z0-9._\-]+")

def redact(text: str) -> str:
    text = SECRET_RE.sub(r"\1: [REDACTED]", text)
    text = BEARER_RE.sub("Bearer [REDACTED]", text)
    return text

def log(msg: str) -> None:
    print(redact(msg), flush=True)

Never log:

private keys / seed phrases
full cookie jars
raw PAT files

Verification

assert "[REDACTED]" in redact("Authorization: Bearer abc.def")
assert "abc.def" not in redact("Authorization: Bearer abc.def")

Notes

Prefer structured logs with explicit allow-listed fields.
Mode 600 on secret files; never commit them.

FilesExpand file tree

log-redaction-secrets.md

Latest commit

History