Log Scrub Contract

Local redaction proof

Know the log is clean before it leaves.

Turn representative JSON, JSONL, and text logs into a regression contract. Scrub known fields, catch secret-shaped leftovers, and fail CI at the boundary.

Install the CLI Try a fixture in this tab

No upload. No telemetry. No reversible masks.

An overhead lab notebook with structured log marks, opaque black redaction bars, and hand-drawn verification ticks.
Evidence, not a vendor promise.
01Path rulesScrub whole JSON values
02Safe regexLinear-time matching
03Runtime tokensSecrets stay out of config
04EntropyCatch unknown leftovers

Live bench test

Introduce a leak. Watch the contract object.

This reduced browser specimen mirrors path, email, token-shape, and entropy checks. It runs entirely in this tab. Add session_material to the path rules to make the supplied fixture pass.

The Rust CLI adds JSONL, runtime tokens, safe configurable regex, reports, and CI exit codes.

After — scrubbedWaiting
Run the contract to inspect this specimen.

Nothing has been evaluated yet.

    The boundary test

    A small contract at every exit.

    1. 1

      Capture representative fixtures

      Use fake, realistically shaped examples for every production drain and support export.

    2. 2

      Declare irreversible rules

      Target JSON paths, regex shapes, and tokens supplied only at runtime. Matches become opaque markers.

    3. 3

      Gate the route out

      Run the same fixtures in CI. A deny assertion or high-entropy remainder exits 1 before deploy.

    Five-minute setup

    One binary. One policy. Exit means something.

    Exit 0 is a passing contract, 1 is a possible leak, and 2 is an invalid invocation, policy, or fixture.

    Terminal
    $ cargo install log-scrub-contract
$ log-scrub init
$ log-scrub check --config log-scrub.json fixtures/

PASS fixtures/drain.json — 3 redactions, 0 violations
Contract passed
    Policy reference CI example Release binaries

    Optional field notes

    Team Pack $29 once

    Keep the complete CLI free. Unlock convenience templates for GitHub Actions, common cloud headers, support bundles, and multi-drain review checklists.

    • 12 annotated policy presets
    • CI matrices for multiple drains
    • Review and incident-response checklists
    • Future template updates for this major version

    One-time purchase. Sociobot/Dodo is the merchant of record; refunds are handled there and revoke the license automatically.

    The free CLI is fully functional.

    Get the Team Pack
    Have a license? Restore it

    Proof of your rules, not a compliance certificate.

    Entropy is a useful alarm, not a verdict. Test every real egress path, review allow patterns, rotate any credential that ever appeared in an uncontrolled log, and keep runtime redaction in place.