What does the Safe-to-Share Sanitizer do?
It makes a local, heuristic pass over .env, JSON, YAML, logs, headers, URLs, and cURL commands. It masks common credential formats and values stored under sensitive field names while preserving the surrounding text where feasible.
How it works locally
Pattern matching and redaction run in this browser tab. The tool does not send the pasted text to OpsecForge, store it in local storage, or include it in analytics events. Closing or refreshing the page clears the current React state.
The Danger of "Beautifiers"
Detection is not exhaustive and a clean-looking result is not proof that all sensitive data was removed. Review every output before sharing. If a real credential was exposed, rotate or revoke it; redaction does not undo an earlier leak.
FAQ
Which secrets do you detect?
The heuristic checks common provider tokens, private-key blocks, authorization and cookie headers, credentials in URLs, sensitive query parameters, JWT-like strings, and values under common password, token, secret, and API-key field names. It can miss custom formats and may flag benign values.
Is the redaction reversible?
No mapping is retained. The output contains replacement markers, not an encrypted or reversible copy. Keep the original private and manually confirm that the draft still contains enough context.
Environment-variable security guides
Redaction helps with a sharing workflow; it does not replace secret storage, rotation, access control, or incident response. Use the guide that matches the decision you need to make.
Are environment variables secure?
Choose safer storage and delivery patterns for development, CI/CD, containers, and production.
Read the secrets-management guide →Did a real secret escape?
Revoke first, determine scope, remove reachable copies, and fix the original leak path.
Open the leak-response guide →