Text to redact.
OptionalmaskChar?: stringCharacter(s) to use for masked positions, passed through to maskText. Default is '*'.
Optionaltypes?: DetectionType[]Which types to redact. Default is 'email', 'phone', and 'creditCard'. 'apiKey', 'ip', and 'jwt' are opt-in only, given their higher false-positive risk (or, for 'jwt', simply being a bearer secret rather than classic PII).
The text with each detected match masked in place.
redact('Contact me at jordan@example.com or 555-123-4567');
// 'Contact me at jo**************** or 55**********'
redact('Card: 4111 1111 1111 1111', { types: ['creditCard'] });
// 'Card: ***************1111'
redact('Key: AKIAIOSFODNN7EXAMPLE leaked', { types: ['apiKey'] });
// 'Key: ******************** leaked'
redact('Server 10.0.0.5 hit by 203.0.113.42', { types: ['ip'] });
// 'Server 10.0.0.5 hit by ************'
Scans free-form text for embedded PII (emails, phone numbers, credit card numbers, public IPv4 addresses) and secrets (API keys/tokens, JWTs) and masks each match in place with maskText — for sanitizing logs, support tickets, or user-generated content before storage or display.
redactis best-effort pattern matching, not a complete PII/secret detector — false negatives are possible, and it shouldn't be relied on as the only safeguard for sensitive data (pair it with review, not use it as a substitute for one). Two gaps worth knowing about specifically:'ip'never matches private/loopback/link-local addresses (10.x,172.16-31.x,192.168.x,127.x,169.254.x), with no option to include them in v1. This is deliberate (masking them destroys debugging value with no privacy benefit), but meanstypes: ['ip']does not mean "every IP" — if your threat model needs that,redactdoesn't cover it yet.'jwt'requires the token fully intact as one unbroken run of base64url characters and dots. A JWT that's been line-wrapped, truncated, or had whitespace injected mid-token — including a truncated header+payload with the signature cut off, which can still leak real claims data — will not match.