Redact Secrets

Overview

You pass text, code, config, or logs; we scan it with a curated, ReDoS-safe detector pack (cloud keys, tokens, private keys, JWTs, credentialed URLs, generic API-key assignments) and replace matches using your chosen redaction mode. We never hand back the full secret — only the placeholder we wrote and a truncated one-way SHA-256 fingerprint you can use to correlate repeats. Do not use this as compliance-grade DLP or as proof that your text is secret-free.

Secrets leak through logs, tickets, and prompts — you need a deterministic way to sanitize content before you store or transmit it.

When to use it

Scope

Non-goals

• Does not guarantee complete secret removal (best-effort)
• Does not validate secrets against external services
• Does not return full secret values
• Does not salt the fingerprint — a low-entropy secret is still guessable from it
• NOT Gitleaks/TruffleHog parity — a curated pattern pack, not a full secret scanner
• Known false negatives: unlisted providers, obfuscated/split secrets, and low-entropy custom tokens will pass through un-redacted

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.redact_secrets","input":{"text":"aws_key = AKIAIOSFODNN7EXAMPLE"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.redact_secrets", {"text":"aws_key = AKIAIOSFODNN7EXAMPLE"});

Errors

Other limits

Limitations

• Does not guarantee complete secret removal (best-effort)
• Does not validate secrets against external services
• Does not return full secret values
• Does not salt the fingerprint — a low-entropy secret is still guessable from it
• NOT Gitleaks/TruffleHog parity — a curated pattern pack, not a full secret scanner
• Known false negatives: unlisted providers, obfuscated/split secrets, and low-entropy custom tokens will pass through un-redacted
• Compliance-grade DLP (best-effort only)
• Semantic PII masking (use text.mask_pii)

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "security.redact_secrets",
  "input": {
    "text": "aws_key = AKIAIOSFODNN7EXAMPLE"
  }
}

Examples

{
  "text": "aws_key = AKIAIOSFODNN7EXAMPLE"
}

{
  "redactedText": "aws_key = [REDACTED_AWS_ACCESS_KEY_ID]",
  "redactionCount": 1,
  "findings": [
    {
      "type": "aws_access_key_id",
      "start": 10,
      "confidence": 0.9,
      "fingerprint": "1a5d44a2dca19669",
      "end": 30,
      "replacement": "[REDACTED_AWS_ACCESS_KEY_ID]"
    }
  ]
}

{
  "text": "nothing secret here"
}

{
  "redactedText": "nothing secret here",
  "redactionCount": 0,
  "findings": []
}

Recommended use cases

• Sanitize logs, tickets, or prompts before storage or transmission
• Scrub agent-generated output before display
• Preflight documents before sharing

Avoid for

• Compliance-grade DLP (best-effort only)
• Semantic PII masking (use text.mask_pii)

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags