Redacting secrets

redact masks matches in the rendered message — browser console, dev terminal, and SSR alike — replacing them with [redacted]. It runs on the stringified payload, so nested object values are covered too.

mtDebug({
  redact: [
    "supersecret", // literal string, every occurrence
    /x-api-key:\s*\S+/, // RegExp, applied globally
    /("password"\s*:\s*)"[^"]*"/, // $1 kept → only the value is masked
  ],
  redactDefaults: true, // also mask JWTs, Bearer tokens, emails, sk_/pk_ keys, secret JSON values
});

$debug("info", { user: "ada@example.com", token: "Bearer abc.def" });
// MARS-TECH Info - {"user":"[redacted]","token":[redacted]}   (with redactDefaults)

The default for secret JSON values replaces the whole quoted value of keys such as token or password, quotes included, which is why token shows [redacted] without quotes.

A RegExp is applied with the global flag forced on; if it carries a $1 capture group, that group is preserved and only the rest of the match is replaced. redactDefaults is opt-in — it errs toward high-confidence patterns and skips bare digit runs to avoid eating order ids and timestamps.

In 0.6, redaction applies to the rendered message only: the stack printed with showStack: true is not masked (fixed in 1.0).