0.1.0

First release: a CLI that masks secrets and personal data in logs so they can be shared safely.

some-command | logscrub > clean.log, or logscrub app.log.

Detectors: AWS access and secret keys, GitHub / GitLab / Slack / Stripe tokens, JWTs, PEM private keys (including multi-line blocks), Authorization headers and long Bearer tokens, user:password@ in URLs, and password= / token= / "api_key": "..." style pairs.

Modes: --check exits 1 if anything would be masked (for CI); --report prints counts per detector, never the matched text; --enable / --disable select detectors; --max-line-bytes bounds memory.

Design:

• Go's RE2 engine, so crafted input cannot cause ReDoS.
• Streams line by line; a line that cannot be scanned within the memory bound is an error (exit 3), never passed through.
• No network access, no files written, and errors and reports never contain input text.
• A "must not change" corpus of realistic logs guards against false positives; fuzz tests check that nothing maskable is left in the output.

Install: download an archive below (linux, macOS, windows; amd64 and arm64) and check it against checksums.txt, or docker run --rm -i ghcr.io/hbenali/logscrub:0.1.0 < app.log.

Not in this release: emails, IPs, credit cards, stable pseudonyms, a config file and the web UI (planned, see docs/SPEC.md). Pattern matching cannot find secrets with no recognisable shape, so review the output before sharing it.