Redact Logs

code.redact_logs

ProductionHeuristic (Class C)Deterministicbest-effortmoderatev1.0.0

File inputNo network

Overview

When you send log text inline or by file reference, we scan for secrets using the platform detectors and, when you choose, selected PII patterns (email, IBAN, IPv4/IPv6). Detection is best-effort; replacement is deterministic and idempotent. We never return original secret values — do not use this as guaranteed data-loss prevention or compliance DLP.

Logs leak secrets and PII. We scrub them deterministically while keeping line structure so diagnostics stay useful.

Reliability

Best-effort detection; replacement is deterministic and idempotent for a pinned detectorProfile. No declared domain failures — oversize input throws validation errors. Absence of findings does not prove a log is clean.

Context footprint

Returns redactedText, counts, bounded findings, warnings, and _meta. A successful call costs 3 execution credits.

When to use it

Before persisting, sharing, or displaying log text you control.

As the only compliance or DLP control — detection is best-effort.

Scope

Note

Redacts secrets and selected PII from logs while preserving structure.

Non-goals

Not guaranteed DLP
Does not return original values
Does not parse arbitrary formats

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

analysisdata-transformation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call3 credits

File handling

Accepts file_refProduces file_refMax input1 MBMax file size50 MB

File limits

Constraints this skill applies to your input and generated files. The “Limited by” column shows the static source of each cap; none of these can be raised by upgrading your plan.

Limit	Value	Limited by
Maximum size per input file	50 MiB	Skill and platform maximum

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response may contain submitted or transformed content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
source	object	Yes	Closed inline or managed-file log source with type, optional content and optional ref.
format	string	No	Log layout; omit it for auto detection.
profile	string	No	Redaction profile; omit it for secrets_only.
options	object	No	Closed result-detail options; omit it to include up to 10,000 findings.

Output schema

Field	Type	Required	Description
redactedText	string	Yes	Redacted log text preserving structure.
redactionCount	integer	Yes	Total replaced span count.
countsByType	object	Yes	Purpose-bound map from detector type names to replacement counts.
findings	array	Yes	From 0 through 10,000 secret findings without original values.
warnings	array	Yes	From 0 through 100 safe advisory strings; currently always empty because the scanner has none.
_meta	object	Yes	Closed log-layout and detector-profile receipt with format, profile and detectorProfile.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"code.redact_logs","input":{"source":{"type":"inline","content":"..."}}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("code.redact_logs", {"source":{"type":"inline","content":"level=info key=AKIAIOSFODNN7EXAMPLE"}});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Not guaranteed DLP
Does not return original values
Does not parse arbitrary formats
Compliance-grade DLP as the sole control
Recovering original values

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "code.redact_logs",
  "input": {
    "source": {
      "type": "inline",
      "content": "level=info key=AKIAIOSFODNN7EXAMPLE"
    }
  }
}

Examples

AWS access key redacted in logfmt

Inputjson

{
  "source": {
    "type": "inline",
    "content": "level=info key=AKIAIOSFODNN7EXAMPLE"
  }
}

Expected outputjson

{
  "findings": [
    {
      "fingerprint": "1a5d44a2dca19669",
      "severity": "error",
      "type": "aws_access_key_id",
      "replacement": "[REDACTED_AWS_ACCESS_KEY_ID]"
    }
  ],
  "_meta": {
    "format": "logfmt",
    "profile": "secrets_only",
    "detectorProfile": "log-redaction-1"
  },
  "redactedText": "level=info key=[REDACTED_AWS_ACCESS_KEY_ID]",
  "warnings": [],
  "redactionCount": 1,
  "countsByType": {
    "AWS_ACCESS_KEY_ID": 1
  }
}

Email redacted when profile includes PII