1.0.0

logscrub 1.0.0: mask secrets and personal data in logs so they can be shared safely. Every feature in the specification (docs/SPEC.md) is implemented.

some-command | logscrub > clean.log
logscrub --check app.log          # CI gate: exit 1 if anything would be masked
logscrub --mode pseudonym app.log # stable tags for emails and IPs
logscrub serve                    # local web UI

What it masks: AWS keys, GitHub / GitLab / Slack / Stripe tokens, JWTs, PEM private keys (including multi-line blocks), Authorization headers, URL credentials, password= / token= / "api_key": ... pairs, email addresses, IPv4 and IPv6 addresses, payment card numbers (Luhn-checked) and, opt-in, phone numbers.

Modes and tools: fixed markers or stable HMAC pseudonyms; a strict TOML config (enable/disable, allow-list, custom RE2 rules); --check and --report for CI (counts only, never the matched text); a local web UI with highlighted matches.

Design: Go's RE2 engine (linear time, no ReDoS); streaming with bounded memory, and a line that cannot be scanned safely is an error, never passed through; no network access; errors and reports never contain input text. A "must not change" corpus of realistic logs, property and chunking tests, and fuzzing guard against false positives and leaks. The web UI binds to loopback only, checks Host and Origin, sends a strict CSP and loads nothing from other sites.

New since 0.3.0: --max-private-key-lines (CLI and serve) bounds how much of a private key block that never closes is masked; a warning is printed when the limit is hit.

Stability: from 1.0, the flags, exit codes, config format and the [REDACTED:id] / [kind:tag] output formats are stable across 1.x. New detectors may be added in minor releases, so a previously clean log can gain matches; --check is how to notice.

Install: archives below (linux, macOS, windows; amd64 and arm64; verify with checksums.txt), docker run --rm -i hbenali/logscrub < app.log (also ghcr.io/hbenali/logscrub), or go install github.com/hbenali/logscrub/cmd/logscrub@latest.

Known limitations: pattern matching cannot find secrets with no recognisable shape (a password in prose, an unlabelled random string) or encoded ones; a plain name: value line is only masked when it looks like YAML; a private key block longer than the limit is only masked up to it. Review the output before sharing it publicly.