Function: redactSecrets()

redactSecrets(text): string

Defined in: src/core/errors.ts:141

Redact what must never reach a log from free text: URL query strings (API keys ride there, e.g. The Odds API's apiKey), user:password@ URL credentials (proxy URLs), and credential-looking text a transport may echo in its error message — Authorization / Proxy-Authorization / X-Api-Key / X-Auth-Token / X-Access-Token / Api-Key / Ocp-Apim-Subscription-Key and Cookie / Set-Cookie values, Bearer <token> / Basic <base64>, JWT-shaped strings, and the value of password / token / accessToken / api_key / client_secret / … pairs (=, : or URL-encoded, also as "password": "…"). Ordinary text is left alone.

Parameters

text

string

Free text that may hold a credential: an error message, a stack, a URL, a header dump.

Returns

string

The same text with each secret replaced by <redacted> (a URL's whole query string becomes ?<redacted>, a URL's user:password@ becomes <redacted>@).

Example

import { redactSecrets } from './core/errors.js'; // not re-exported from the package root

redactSecrets('https://api.the-odds-api.com/v4/sports?apiKey=abc123');
// 'https://api.the-odds-api.com/v4/sports?<redacted>'
redactSecrets('Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.e30.sig');
// 'Authorization: <redacted>'

Remarks

Every pattern is linear in the input (a test bounds 100 KB of adversarial input at under 50 ms). A bare Bearer x is redacted only when x looks like a credential (8+ characters with a digit or symbol, or 20+), a bare key=x only when x is 16+ characters, so prose such as "Bearer token required" or "primary key=player_id" survives. Every error message sportsdataverse builds goes through this; call it yourself before logging text from a third-party HTTP client.