redact-env\n Redact values of critical environment variables in a string.\n
\n\n## ⚠️ Disclaimer\n\nThis library might not do exactly what you want it to.\n\nAs for anything related to security, read the [caveats](#caveats), check\nout the [source code](./src/index.ts) and the [tests](./src/index.test.ts)\nbefore using it in production.\n\n## Installation\n\n```shell\n$ yarn add redact-env\n# or\n$ npm i redact-env\n```\n\n## Usage\n\n```ts\nimport * as redactEnv from 'redact-env'\n\nconst secrets = redactEnv.build(['SECRET_ENV_VAR', 'MY_API_KEY'])\n\nconst unsafeString = `\n ${process.env.SECRET_ENV_VAR}\n Oh no, the secrets are leaking !\n ${process.env.MY_API_KEY}\n`\nconsole.log('unsafe:', unsafeString)\n\nconst safeString = redactEnv.redact(unsafeString, secrets)\nconsole.log('safe:', safeString)\n```\n\n```\nunsafe:\n QfKcO7cjGoxnLg/28/E7meEu2QaS/wNtFB7wlz+hDZA=\n Oh no, the secrets are leaking !\n d9fd627cfd3d6cb597e8faeb2ef0e4583af924aee047125479b2438ee2a18b67\n\nsafe:\n [secure]\n Oh no, the secrets are leaking !\n [secure]\n```\n\n## Caveats\n\n### Un-redacted values\n\n`redact-env` will **NOT** redact the following environment variable values:\n\n- `\"true\"`\n- `\"false\"`\n- `\"null\"`\n\nThis is because these string-encoded JSON values are not specific to a\nsingle environment variable, and redacting all the booleans and nulls in\na string seems overzealous. This is opinionated for a particular usage.\n\n### Parsed numbers in JSON object\n\n`redact-env` **WILL** redact numbers in environment variable values,\nwhich will pose a problem if you parse them and dump them as numbers in a\nJSON object:\n\n```ts\nimport * as redactEnv from 'redact-env'\n\nprocess.env.PIN = '1234'\n\nconst secrets = redactEnv.build(['PIN'], process.env)\n\nconst pin: number = parseInt(process.env.PIN)\n\nconst unsafe = JSON.stringify({ pin })\nconsole.log(unsafe)\n// {\"pin\":1234} => valid JSON\n\nconst safeButIncorrect = redactEnv.redact(unsafe, secrets)\n\nconsole.log(safeButIncorrect)\n// {\"pin\":[secure]} => not valid JSON\n```\n\n### Windows paths in JSON objects\n\nBecause of backslash-delimited paths in Windows and string escaping\noccurring in `JSON.stringify`, Windows paths in environment variables\nwon't be redacted if present in JSON strings.\n\nIn a future release, we might consider detecting the presence of\nbackslashes in the environment variable value and having two regexp for\nthis secret (one for the plain value and one backslashed-escaped).\n\n## License\n\n[MIT](https://github.com/47ng/redact-env/blob/master/LICENSE) - Made with ❤️ by [François Best](https://francoisbest.com)\n\nUsing this package at work ? [Sponsor me](https://github.com/sponsors/franky47) to help with support and maintenance.\n","readmeFilename":"README.md"}