Skip to content

Get‑ShpRedactionPolicy

Raimund edited this page Sep 7, 2026 · 2 revisions

SYNOPSIS

Returns the custom secret-redaction rules in force for this session.

SYNTAX

Get-ShpRedactionPolicy [<CommonParameters>]

DESCRIPTION

Reads the additional rule set applied by Set-ShpRedactionPolicy. Returns nothing when no custom rules have been added - that is NOT the same as "no redaction is happening": the module's built-in patterns (GitHub tokens, AWS access key ids, PEM private-key blocks, JWTs, basic-auth URL credentials, and connection-string password fields) are always active regardless of this policy, and are turned off only by Invoke-Shp -DisableRedaction.

Use it to audit what EXTRA patterns an unattended run was given. See an Invoke-Shp result's Redactions member for what actually matched on a given call (pattern name and count only - never the matched value).

SecretEnvironmentVariable contains only caller-selected variable names. Their values are resolved at egress and are never returned in this policy.

EXAMPLES

EXAMPLE 1

Get-ShpRedactionPolicy

Returns the current custom rules, or nothing if none have been added.

EXAMPLE 2

(Get-ShpRedactionPolicy).Rule | Format-Table Name, Pattern

Lists the custom rules in force.

PARAMETERS

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

System.Management.Automation.PSCustomObject

A ShellPilot.RedactionPolicy with the parsed Rule set and the Source it

came from, or nothing when no custom policy is set.

NOTES

RELATED LINKS

Set-ShpRedactionPolicy

Clear-ShpRedactionPolicy

Clone this wiki locally