File size: 716 Bytes
47bf6fa | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | from __future__ import annotations
import re
SECRET_PATTERNS = [
re.compile(r"hf_[A-Za-z0-9_\-]{20,}"),
re.compile(r"Bearer\s+[A-Za-z0-9_\.\-]+", re.IGNORECASE),
re.compile(r"(HF_TOKEN|OAUTH_TOKEN|ACCESS_TOKEN|AUTHORIZATION|PASSWORD|SECRET)\s*[:=]\s*[^\s]+", re.IGNORECASE),
]
def redact(text: str | None) -> str:
"""Best-effort redaction for logs/reports shown in the UI.
This is intentionally conservative. It is not a complete DLP system,
but it protects against obvious token leaks in first-version outputs.
"""
if not text:
return ""
redacted = text
for pattern in SECRET_PATTERNS:
redacted = pattern.sub("[REDACTED]", redacted)
return redacted
|