Repository navigation
Add a redaction filter for secrets - #55
Merged
Merged
Conversation
## Summary Secrets passed through `extra=`, the log context or the message text were written to every handler as they were. ## Changes - `RedactionFilter` masks fields whose name contains any configured key (case-insensitive substring, so `token` also masks `access_token`), searching nested dictionaries, lists and tuples on a copy so caller objects are never modified. Optional regular expressions mask matches in the message text. - `setup_logging(redact_keys=..., redact_patterns=...)` attaches it to every handler after the context filter, so console, files, JSON and syslog are all covered, and global context and adapter fields are included. With `use_queue` it runs before the record is queued. - `DEFAULT_REDACT_KEYS` lists common names (`password`, `token`, `authorization`, `api_key` and so on). Redaction is off by default, so existing output does not change. - Standard record attributes (`name`, `msg` and so on) are never masked, and a message without a match keeps its arguments. - README section, changelog, and tests for matching, nesting, idempotence, JSON output, context fields and the queue. ## Limitation Tracebacks are not searched. This is documented. ## Verification - `pytest`: 144 passed (latest dependencies) and 122 passed with 22 skipped (no extras). `ruff` and `mypy --strict` are clean. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01U2nYHVGDdthQpcwNBPbp8r
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Secrets passed through
extra=, the log context or the message text were written to every handler as they were.Changes
RedactionFiltermasks fields whose name contains any configured key (case-insensitive substring, sotokenalso masksaccess_token), searching nested dictionaries, lists and tuples on a copy so caller objects are never modified. Optional regular expressions mask matches in the message text.setup_logging(redact_keys=..., redact_patterns=...)attaches it to every handler after the context filter, so console, files, JSON and syslog are all covered, and global context and adapter fields are included. Withuse_queueit runs before the record is queued.DEFAULT_REDACT_KEYSlists common names (password,token,authorization,api_keyand so on). Redaction is off by default, so existing output does not change.name,msgand so on) are never masked, and a message without a match keeps its arguments.Limitation
Tracebacks are not searched. This is documented.
Verification
pytest: 144 passed (latest dependencies) and 122 passed with 22 skipped (no extras).ruffandmypy --strictare clean.Closes #24
🤖 Generated with Claude Code
https://claude.ai/code/session_01U2nYHVGDdthQpcwNBPbp8r
Generated by Claude Code