Credential URIs

Scan and redact

from datafog_core import scan_and_transform

text = "DB=postgresql://app:p%40ss@db.example.com:5432/app?sslmode=require"
result = scan_and_transform(text, {
    "transform": {
        "default": {"strategy": "redact"},
        "entities": ["CREDENTIAL_URI"],
    }
})
assert result.text == "DB=[CREDENTIAL_URI]"

// Node; browser WASM uses the same operation after await init().
import { scanAndTransform } from "@datafog/node";
const result = scanAndTransform("DB=postgres://app:secret@localhost/app", {
  transform: { default: { strategy: "redact" }, entities: ["CREDENTIAL_URI"] },
});
console.assert(result.text === "DB=[CREDENTIAL_URI]");

Recognized syntax and boundaries

• A single ASCII hostname (including underscore), IPv4 address, or bracketed IPv6 address is supported. Hostname labels cannot be empty or start/end with a hyphen. Labels are limited to 63 bytes and the host to 253 bytes; a final hostname dot is accepted. An omitted host uses the recognizable libpq local-default shape, such as postgres://app:secret@/app.
• A port, when supplied after a colon, must contain one or more ASCII digits. No port range or connectivity check is performed.
• User information, paths, and queries accept RFC 3986 component characters and valid %HH triplets. Non-ASCII user information, paths, and queries must be percent encoded; hostnames must use their ASCII representation. Surrounding Unicode text retains correct byte, code-point, and JavaScript UTF-16 offsets.
• Whitespace, double quotes, angle brackets, braces, and backticks delimit a URI. Single quotes delimit it when the scheme immediately follows an opening single quote; otherwise an apostrophe can occur as URI data. Matching enclosing parentheses or square brackets are excluded from the finding. Bracketed IPv6 hosts and parentheses inside a URI are retained.
• RFC-valid final punctuation in a path or query is retained. For example, postgres://app:secret@db/app, includes the final comma. Prose punctuation and URI data are ambiguous; use explicit quoting when a precise boundary matters.
• A scheme embedded in an ASCII identifier or another scheme prefix is rejected. Invalid percent encoding, authority syntax, ports, or suffixes reject the candidate rather than emitting a shortened valid prefix.

Initial exclusions

Findings and transformations