| import logging | |
| import re | |
| SENSITIVE_PATTERNS = [ | |
| r"(?i)\b(api[_-]?key|token|secret|authorization|password|passwd)\b", | |
| r"(?i)(?<![A-Za-z0-9._-])sk-[A-Za-z0-9]{4,}(?![A-Za-z0-9._-])", | |
| r"(?i)Bearer\s+[A-Za-z0-9._-]+", | |
| ] | |
| def redact_sensitive_data(value: str) -> str: | |
| if not isinstance(value, str): | |
| return value | |
| redacted = value | |
| for pattern in SENSITIVE_PATTERNS: | |
| redacted = re.sub(pattern, "[REDACTED]", redacted) | |
| # Mask any remaining inline secret-looking values after the regex pass. | |
| redacted = re.sub(r"(?i)(\b(?:api[_-]?key|token|secret|authorization|password|passwd)\s*[:=]\s*)([^\s,;]+)", r"\1[REDACTED]", redacted) | |
| redacted = re.sub(r"(?i)\b(bearer)\s+([A-Za-z0-9._-]+)", r"\1 [REDACTED]", redacted) | |
| return redacted | |
| def get_safe_logger(name: str) -> logging.Logger: | |
| return logging.getLogger(name) | |