Ecosystem: zod-redact

[holoflash]

In a project I maintain that handles a lot of PII and has very incomplete test data, presenting new features to stakeholders always means creating mock data and writing throw-away code to swap out real values just to be able to demo in production.

After getting frustrated with this, I built a small Zod plugin that lets you annotate schema fields with replacement values. The plugin adds a parseAndRedact() version of each parse() function variant (safe and async). The annotated fields are swapped out after validation and everything else works exactly like normal.

I'm using this plugin by having a global "presentation mode" flag which is then used to conditionally choose which parsing path to take. In my schemas, I'm only annotating the sensitive personal information for redaction so that everything looks just like production in presentations but nothing sensitive is exposed.

Replacements can be static values, arrays to pick from, or functions:

import { redact, parseAndRedact } from "zod-redact";

const User = z.object({
  id: z.string(),
  name: redact(z.string(), "***"),
  email: redact(z.string(), ["a@example.com", "b@example.com"]),
  ssn: redact(z.string(), (seed) => `XXX-XX-${seed.slice(-4)}`),
});

parseAndRedact(User, realData);
// PII fields are replaced; non-annotated fields pass through unchanged

Array picks and function calls are deterministic and the same input always produces the same output. This means that the same real data across different schemas will result in the same "fake data" providing continuity across different pages.

There's also a combine() helper for composing realistic fake data from multiple arrays (building a full name and email from shared first/last name pools for example), keeping the picks consistent across fields.

• GitHub: https://github.com/holoflash/zod-redact
• npm: https://www.npmjs.com/package/zod-redact
• X: @redasjefisovas