Redact values of critical environment variables in a string

Downloads in past


661.0.0a year ago4 years agoMinified + gzip package size for redact-env in KB


🔒👀 redact-env

NPM MIT License CI/CD Coverage Status

Redact values of critical environment variables in a string.

⚠️ Disclaimer

This library might not do exactly what you want it to.
As for anything related to security, read the caveats, check out the source code and the tests before using it in production.


$ yarn add redact-env
# or
$ npm i redact-env


import * as redactEnv from 'redact-env'

const secrets =['SECRET_ENV_VAR', 'MY_API_KEY'])

const unsafeString = `
  Oh no, the secrets are leaking !
console.log('unsafe:', unsafeString)

const safeString = redactEnv.redact(unsafeString, secrets)
console.log('safe:', safeString)

  Oh no, the secrets are leaking !

  Oh no, the secrets are leaking !


Un-redacted values

redact-env will NOT redact the following environment variable values:
  • "true"
  • "false"
  • "null"

This is because these string-encoded JSON values are not specific to a single environment variable, and redacting all the booleans and nulls in a string seems overzealous. This is opinionated for a particular usage.

Parsed numbers in JSON object

redact-env WILL redact numbers in environment variable values, which will pose a problem if you parse them and dump them as numbers in a JSON object:
import * as redactEnv from 'redact-env'

process.env.PIN = '1234'

const secrets =['PIN'], process.env)

const pin: number = parseInt(process.env.PIN)

const unsafe = JSON.stringify({ pin })
// {"pin":1234} => valid JSON

const safeButIncorrect = redactEnv.redact(unsafe, secrets)

// {"pin":[secure]}  => not valid JSON

Windows paths in JSON objects

Because of backslash-delimited paths in Windows and string escaping occurring in JSON.stringify, Windows paths in environment variables won't be redacted if present in JSON strings.
In a future release, we might consider detecting the presence of backslashes in the environment variable value and having two regexp for this secret (one for the plain value and one backslashed-escaped).


MIT - Made with ❤️ by François Best
Using this package at work ? Sponsor me to help with support and maintenance.