log-redaction-auditor

When to invoke

• You have application logs (text) and want to check whether secrets/PII might be present.
• You want a repeatable, automated check in CI/CD before sharing logs externally.

Inputs needed

• --input path to a log file (UTF-8 text).
• Optional: --config path to a JSON config overriding patterns and allowlists.

Workflow

1. Scan log lines with conservative rules for likely secrets/PII.
2. Apply allowlists (known test keys/domains) to reduce false positives.
3. Emit a JSON report with counts, examples, and line numbers.

Output format

• JSON written to --output with:
  • summary: counts by severity and rule.
  • findings: list of matches with severity, rule_id, line_number, match, and context.