Redacting Sensitive Data in API Logs: In-Browser Token, Email & IP Masking

What is Client-Side API Log Redaction?

Debugging complex microservice issues frequently requires sharing API logs, HTTP headers, and JSON error responses with team members, third-party vendor ticket systems, or LLM AI assistants (such as ChatGPT or Claude).

However, unsanitized production logs often contain sensitive credentials, including Authorization Bearer JWT tokens, database passwords, API keys, customer email addresses, and internal server IP addresses. Unintentional exposure of these credentials can lead to severe security breaches and compliance violations (GDPR/HIPAA).

Key Sensitive Credential Patterns

1. Authorization Headers & JWTs: Bearer eyJhbGciOiJIUzI1NiIsInR5c...
2. PII Email Addresses: john.doe@company.org
3. Internal IPv4 / IPv6 Addresses: 192.168.1.42 or 2001:db8::1
4. Sensitive JSON Keys: Properties containing password, secret, api_key, or credit_card.

Browser-Local Masking Algorithm

Run redaction in local browser memory before text is copied or submitted. Pattern-based masking reduces accidental exposure, but it is not an exhaustive security scanner; review the output before sharing it:

export function redactSensitiveData(input: string, customKeysRegex = "password|secret|token|api_key"): { redactOutput: string; itemsMasked: number } {
    let output = input;
    let count = 0;

    // 1. Mask Bearer / JWT Tokens
    output = output.replace(/(Bearers+)[A-Za-z0-9-._~+/]+=*/g, () => {
        count++;
        return "Bearer [REDACTED_TOKEN]";
    });

    // 2. Mask Email Addresses
    output = output.replace(/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}/g, () => {
        count++;
        return "[REDACTED_EMAIL]";
    });

    // 3. Mask IPv4 Addresses
    output = output.replace(/(?:d{1,3}.){3}d{1,3}/g, () => {
        count++;
        return "[REDACTED_IP]";
    });

    return { redactOutput: output, itemsMasked: count };
}

Frequently Asked Questions (FAQ)

Q1: Are my raw API logs sent to a server during redaction?

The redaction logic runs in browser memory and does not intentionally transmit pasted logs. Before using production data, review the deployed scripts, minimize the payload, and follow your organization's data policy.

Q2: Can I customize the key pattern regex to match my company's custom secret headers?

Yes! You can customize the target key regex pattern (e.g. password|secret|auth_token|client_secret) directly on our Sensitive Data Redactor tool.

Q3: What sensitive data patterns are auto-detected by default?

Our redactor automatically detects and masks Bearer/JWT headers, email addresses, IPv4/IPv6 addresses, and JSON attributes matching common secret key names.