Redact

redact

Pipe-based secret masking. Shows first 4 + last 4 chars for identification without exposing the full value.

Usage

# Pipe any output containing secrets
echo $GITEA_API_KEY | redact                  # → fc1d...4439
curl -s http://host/api | redact              # masks tokens in JSON
some-command 2>&1 | redact                    # masks in logs

# Direct arg
redact $SOME_TOKEN                            # → abcd...wxyz

# Custom reveal length
echo $TOKEN | redact --head 6 --tail 6        # → fc1df7...345360

When to Use

Always when you need to reference or verify a secret:

# ❌ NEVER
echo "Token: $GITEA_API_KEY"
TOKEN="abc123..."
echo $TOKEN

# ✅ ALWAYS
echo $GITEA_API_KEY | redact
echo "Token: $(echo $GITEA_API_KEY | redact)"

Auto-Detected Patterns

• 40-char hex strings (Gitea, SHA-like)
• ghp_ / ghs_ GitHub tokens
• glpat- GitLab tokens
• Authorization: bearer/token <value> headers
• api_key=, auth_token=, password=, secret=, token= key-value pairs

Installation

Script lives at ~/.local/bin/redact (Python 3, no dependencies). Available on all hosts where ~/.local/bin is in PATH.

Fleet Distribution

ansible pis:nas:workstations -i ansible/inventory -m copy \
  -a "src=~/.local/bin/redact dest=~/.local/bin/redact mode=0755"