redact scans text files (logs, configuration files, support bundles) and replaces sensitive data with placeholder tags before you share them publicly - for example when opening a bug report, posting to a forum, or attaching output to a support ticket.

Detected and redacted by default:

• IPv4 and IPv6 addresses (all common notations, including compressed and loopback forms)
• MAC addresses
• Email addresses
• Hostnames / FQDNs (generic TLD/suffix detection, e.g. .com, .net, .internal, .local, .corp, .lan, .intranet, .io, .dev, .cloud, ...)
• Credentials: AWS access keys, GitHub/Slack tokens, JWTs, Bearer tokens, PEM private key blocks, and password/api_key/secret/token assignments in config files

You can also pass one or more --domain flags to redact client-specific domains that aren't covered by the generic hostname detection (useful when working across multiple client engagements with different internal domains).

The original file is never modified - a new file with a .redacted suffix is written next to it (or output goes to stdout with --stdout).

Usage: redact file.log redact *.log config.yaml redact file.log --domain client.example --domain internal.client.net redact file.log --stdout