Skip to content

Feature/loki secret scrubbing#22

Merged
simsteward merged 2 commits intomainfrom
feature/loki-secret-scrubbing
Mar 26, 2026
Merged

Feature/loki secret scrubbing#22
simsteward merged 2 commits intomainfrom
feature/loki-secret-scrubbing

Conversation

@simsteward
Copy link
Copy Markdown
Owner

No description provided.

wgutmann and others added 2 commits March 25, 2026 02:16
Document the new enrichment metrics derived by loki-log.js:
tool duration, payload sizes, retry detection, error classification,
agent topology, session lifecycle, and the SessionEnd token sidecar.
Update component label values to match current bucketing (tool,
lifecycle, agent, user instead of generic hook).

The loki-log.js implementation lives at ~/.claude/hooks/loki-log.js
(outside this repo) and is already deployed and producing enriched
log entries in Loki.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a compiled regex-based scrubSecrets() function to loki-log.js that
redacts secrets (AWS keys, GitHub tokens, Sentry DSNs, JWTs, Bearer tokens,
PEM keys, URI credentials, env var assignments) from all log payloads before
they reach Grafana/Loki. Single-pass string replace, ~0.1ms overhead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@simsteward simsteward merged commit b69cda3 into main Mar 26, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants