.___                 __    
_______   ____    __| _/_____     ____ _/  |_  
\_  __ \_/ __ \  / __ | \__  \  _/ ___\\   __\ 
 |  | \/\  ___/ / /_/ |  / __ \_\  \___ |  |   
 |__|    \___  >\____ | <____  / \___  >|__|   
             \/      \/      \/      \/        

CLI tool to detect and redact sensitive information from text. 

---

Installation

git clone https://github.com/avalianiz/redact.git
cd redact
chmod +x index.js
npm link

Quick Start

redact input.txt --out output.txt          # redact and save
redact input.txt --show                    # preview without changing anything
cat debug.log | redact --only emails,keys  # pipe + selective redaction
redact --list-types                        # see all supported types

Usage

redact [file] [options]
cat file | redact [options]

Option	Description
--show	Dry-run: print what would be redacted with line numbers and context
--only <types>	Comma-separated list of types to redact (e.g. emails,jwt,ip)
--out <file>	Save output to file instead of stdout
--mapping <file>	Override the auto-generated mapping file path
--unredact <map>	Reverse a redaction using a .mapping.json file
--list-types	Show all available redaction types
--help, -h	Show help

How It Works

Matched values are replaced with indexed placeholders:

john@example.com      →  [EMAIL_1]
sk-proj-abc123...     →  [API_KEY_1]
192.168.1.100         →  [IP_ADDRESS_1]

When you use --out, a .mapping.json is saved alongside the output so you can reverse the redaction later:

redact clean.txt --unredact clean.mapping.json   # restores original values

Supported Types

Type	Confidence	Aliases
EMAIL	high	email, emails
API_KEY	medium	key, keys, apikey
AWS_KEY	high	aws, aws_key
AWS_SECRET	high	aws_secret
JWT	high	jwt, jwts
CREDIT_CARD	medium	cc, creditcard
SSN	high	ssn
GEORGIAN_ID	medium	georgian_id, geo_id
IP_ADDRESS	high	ip, ips
PHONE	medium	phone, phones
PRIVATE_KEY	high	private_key

Examples

# Sanitize a log file, then recover it
redact server.log --out server_safe.log
redact server_safe.log --unredact server_safe.log.mapping.json --out server_original.log

# Only redact AWS credentials in a config file
redact config.yml --only aws_key,aws_secret --out config_safe.yml

# Pipe grep output through redact
grep "ERROR" app.log | redact --only emails,ip

# Batch redact a folder of logs
for f in logs/*.log; do redact "$f" --out "safe/$f"; done

License

MIT