When to invoke
- You have application logs (text) and want to check whether secrets/PII might be present.
- You want a repeatable, automated check in CI/CD before sharing logs externally.
Inputs needed
--inputpath to a log file (UTF-8 text).- Optional:
--configpath to a JSON config overriding patterns and allowlists.
Workflow
- Scan log lines with conservative rules for likely secrets/PII.
- Apply allowlists (known test keys/domains) to reduce false positives.
- Emit a JSON report with counts, examples, and line numbers.
Output format
- JSON written to
--outputwith:summary: counts by severity and rule.findings: list of matches withseverity,rule_id,line_number,match, andcontext.
Guardrails
- Do not modify the input logs.
- Avoid printing raw secrets to stdout; only write to output file.
- Provide an allowlist mechanism to reduce false positives.
Reference code
log_redaction_auditor.pyimplements the scanner using Python stdlib regex + JSON.