Secrets Detection

Rehydra can detect secrets and credentials embedded in text, config files, and environment variables. Secrets detection is opt-in — enable it when your workflow handles content that may contain credentials.

Enable Secrets Detection

import { createAnonymizer } from 'rehydra';

const anonymizer = createAnonymizer({
  secrets: { enabled: true },
});
await anonymizer.initialize();

const result = await anonymizer.anonymize(
  'Connect with postgres://admin:s3cret@db.internal:5432/app'
);
// "Connect with <PII type="CONNECTION_STRING" id="1"/>"

What Gets Detected

API Keys (API_KEY)

Provider-specific key patterns including:

OpenAI — sk-proj-*, sk-*
Anthropic — sk-ant-*
GitHub — PATs (ghp_*), OAuth (ghu_*), App tokens (ghs_*)
Stripe — sk_live_*, sk_test_*, rk_*
Slack — xoxb-*, xoxp-*, xoxa-*, xoxs-*
SendGrid — SG.*.*
Twilio — SK followed by 32 hex characters
Mailgun — key- followed by 32 hex characters

Private Keys (PRIVATE_KEY)

PEM-encoded private key blocks with BEGIN/END markers. Supports RSA, EC, DSA, OpenSSH, PGP, and encrypted variants.

JSON Web Tokens (JWT)

Three-segment base64url tokens starting with eyJ. Validates that the decoded header contains an alg field.

Connection Strings (CONNECTION_STRING)

Database and service URIs with embedded credentials:

PostgreSQL — postgres://user:pass@host/db
MySQL / MariaDB — mysql://user:pass@host/db
MongoDB — mongodb+srv://user:pass@host/db
Redis — redis://:pass@host:port
AMQP — amqp://user:pass@host:port

Placeholder passwords like changeme or password are ignored.

AWS Credentials (AWS_CREDENTIALS)

Access key IDs with the AKIA prefix (high confidence)
Secret access keys when AWS-related context keywords are present (context-dependent)

Environment Variable Secrets (ENV_VAR_SECRET)

Secret values in .env-style lines like API_KEY=sk-abc123. The recognizer checks whether the key name suggests a secret (e.g., names containing password, secret, token, api_key, etc.) and filters out placeholder values.

Config File Secrets (CONFIG_SECRET)

Secret values in JSON, YAML, and TOML configuration files. Uses the same key name heuristics as the environment variable recognizer.

{ "database_password": "s3cret-value" }

api_secret: sk-live-abc123

Scanning .env Files

Point Rehydra at your .env files so it can learn the exact secret values and detect them anywhere in the text — even outside of KEY=VALUE context:

const anonymizer = createAnonymizer({
  secrets: {
    enabled: true,
    envFiles: ['.env', '.env.local'],
  },
});

This parses the files, extracts the values, and registers a literal value recognizer that matches those exact strings with maximum confidence.

Explicit Redact Values

If you know specific values that should always be redacted, pass them directly:

const anonymizer = createAnonymizer({
  secrets: {
    enabled: true,
    redactValues: ['my-production-api-key', 'db-password-here'],
  },
});

Custom Key Name Patterns

The built-in key name heuristic covers common names like password, secret, token, api_key, connection_string, and about 30 others. To extend it:

const anonymizer = createAnonymizer({
  secrets: {
    enabled: true,
    secretKeyPatterns: [
      /^INTERNAL_.*_KEY$/i,
      /^MY_APP_SECRET_/i,
    ],
  },
});

These extra patterns apply to ENV_VAR_SECRET and CONFIG_SECRET detection.

Minimum Value Length

Short values like "yes" or "0" are skipped by default. Adjust the threshold if needed:

const anonymizer = createAnonymizer({
  secrets: {
    enabled: true,
    minValueLength: 8, // default is 4
  },
});

Full Configuration Reference

interface SecretsConfig {
  enabled: boolean;              // Enable secrets detection
  envFiles?: string[];           // .env file paths to parse
  redactValues?: string[];       // Explicit values to always redact
  secretKeyPatterns?: RegExp[];  // Additional key name patterns
  minValueLength?: number;       // Minimum value length (default: 4)
}

Enable Secrets Detection

What Gets Detected

Scanning .env Files

Explicit Redact Values

Custom Key Name Patterns

Minimum Value Length

Full Configuration Reference

Next Steps

PII Types

Custom Recognizers

​Enable Secrets Detection

​What Gets Detected

​Scanning .env Files

​Explicit Redact Values

​Custom Key Name Patterns

​Minimum Value Length

​Full Configuration Reference

​Next Steps

PII Types

Custom Recognizers

Enable Secrets Detection

What Gets Detected

Scanning .env Files

Explicit Redact Values

Custom Key Name Patterns

Minimum Value Length

Full Configuration Reference

Next Steps