@dynamic-labs/redaction

Credential and key-material redaction shared by Dynamic backends and browser clients: a key denylist, credential-shaped free-text patterns, a non-mutating deep redactor, and Datadog RUM/Logs beforeSend scrubbers.

Imports nothing — no pino, no node built-ins — so it is safe in a browser bundle. @dyn-observability/logger applies these rules to every record it emits; use this package directly when the sink is not pino.

Public API

Structured redaction

import {
  DEFAULT_REDACT_KEYS,
  KEY_MATERIAL_TEXT_PATTERNS,
  redact,
} from '@dynamic-labs/redaction';

const safe = redact(context, DEFAULT_REDACT_KEYS, {
  textPatterns: KEY_MATERIAL_TEXT_PATTERNS,
  maxDepth: 4,
  maxArrayLength: 20,
});

• Keys: case-insensitive substring match over DEFAULT_REDACT_KEYS — authorization, cookie, token, password, secret, api-key/apikey, jwt, passphrase, credential, mnemonic — at ANY depth. DEFAULT_REDACT_KEY_PATTERNS covers the shapes a substring misses: private_key/privateKey, seedPhrase, session-signature, encrypted*Share/*Backup/*Data, key-share and EAC material under any owner prefix (*keyShare(s), *eac(s) — end-anchored, so keyShareId and externalKeyShareId stay legible), and the config/headers/request branches an axios error carries.
• Free text: surviving strings, error messages and stacks are scrubbed of credential-shaped runs — Authorization: values, Bearer/Basic credentials, JWTs and dyn_* keys.
• Boolean values survive a matching key name: hasPassword, passwordEncrypted and friends stay queryable, since a boolean carries no credential material. An explicit paths rule still redacts them.
• Errors become { type, message, stack } plus their redacted enumerable own-properties, matching pino's stdSerializers.err shape.
• The input is never mutated; cycles collapse to [Circular].

RedactOptions beyond paths / allow / patterns:

• textPatterns — extra free-text patterns. KEY_MATERIAL_TEXT_PATTERNS (long hex, base58) is opt-in: those shapes are also EVM addresses, tx hashes and block hashes, so they only pay off where chain identifiers are not logged. OPAQUE_RUN_TEXT_PATTERNS (any 32+ run of [A-Za-z0-9+=_]) is opt-in for the same reason: it catches credentials of unrecognized shape in untrusted text — a dependency's error string — and excludes separators so URLs, hostnames and UUIDs stay legible.
• maxDepth — depth at which a nested value collapses to [REDACTED]. Unbounded by default.
• maxArrayLength — number of array entries kept. Unbounded by default.

Datadog browser SDKs

scrubRumEvent and scrubLogEvent scrub an event in place for the beforeSend hooks, defaulting to BROWSER_REDACT_OPTIONS (key-material text patterns, depth 4, 20 array entries — the hook runs on the UI thread for every event).

import { scrubLogEvent, scrubRumEvent } from '@dynamic-labs/redaction';

datadogRum.init({ beforeSend: (event) => scrubRumEvent(event) });
datadogLogs.init({ beforeSend: (event) => scrubLogEvent(event) });

scrubRumEvent redacts action target names that carry key material and, for error events, the error message and stack. scrubLogEvent redacts the message, the error message and stack, and every caller-supplied attribute (Datadog's typed message/date/status are handled separately so their shape survives).

Both return false — dropping the event — for an error raised by a browser wallet extension, whose inpage script runs in the page and otherwise dominates a catch-all error monitor. scrubLogEvent also downgrades a transient network failure (blocked or aborted request, EIP-1193 provider disconnect) from error to warn instead of dropping it. isExtensionNoise, isNetworkError and downgradeNetworkErrors are exported for callers that classify events themselves.