What does the Safe-to-Share Sanitizer do?
It makes a local, heuristic pass over .env, JSON, YAML, logs, headers, URLs, and cURL commands. It masks common credential formats and values stored under sensitive field names while preserving the surrounding text where feasible.
How it works locally
Pattern matching and redaction run in this browser tab. The tool does not send the pasted text to OpsecForge, store it in local storage, or include it in analytics events. Closing or refreshing the page clears the current React state.
The Danger of "Beautifiers"
Detection is not exhaustive and a clean-looking result is not proof that all sensitive data was removed. Review every output before sharing. If a real credential was exposed, rotate or revoke it; redaction does not undo an earlier leak.
FAQ
Which secrets do you detect?
The heuristic checks common provider tokens, private-key blocks, authorization and cookie headers, credentials in URLs, sensitive query parameters, JWT-like strings, and values under common password, token, secret, and API-key field names. It can miss custom formats and may flag benign values.
Is the redaction reversible?
No mapping is retained. The output contains replacement markers, not an encrypted or reversible copy. Keep the original private and manually confirm that the draft still contains enough context.