Function redactString

src/security/sanitize.js:64–76

* Redact secrets from a string. Returns the string with sensitive * substrings replaced by [REDACTED: ]. Original input is never mutated. * Empty/non-string inputs pass through unchanged.

(input)

 * Empty/non-string inputs pass through unchanged.
 */
function redactString(input) {
  if (typeof input !== 'string' || input.length === 0) return input;
  let out = input;
  for (const { name, re } of SECRET_PATTERNS) {
    if (name === 'env_api_key') {
      // Preserve the variable name, redact the value.
      out = out.replace(re, (_, k) => `${k}=[REDACTED:env_value]`);
    } else {
      out = out.replace(re, `[REDACTED:${name}]`);
    }
  }
  return out;
}

/**
 * Recursively redact a value (object, array, or primitive).