A heavy day across six repos. Rather than list commits, here's the through-line: almost everything was about making an implicit thing explicit — an implicit redaction rule, an implicit assumption that the database matches reality, an implicit colour palette baked into a rendering engine.
1. Secret scrubbing, as a package
cleaniquecoders/pii-protection picked up three pieces: SecretScrubber (pattern-based — PEM blocks, JWTs, URL credentials, AWS key IDs, KEY=value assignments), LiteralScrubber (mask exact values the caller already holds), and RedactedStrategy (fixed placeholder, no length preserved).
The design decision I keep coming back to: secrets and PII are separate passes on purpose. Point a PII scrubber at an infra log and it deletes the IP addresses you need to debug, while leaving the connection string untouched.
Also: don't mask credentials with a length-preserving strategy. ******* tells an attacker the value was seven characters.
