Default regex-based redactor for common high-precision secret patterns.

Matches and replaces:

• Email addresses (EMAIL)
• PEM private key blocks (PRIVATE_KEY)
• JSON Web Tokens (JWT)
• Anthropic API keys (ANTHROPIC_KEY)
• OpenAI/Stripe-style sk- keys (API_KEY)
• GitHub personal/OAuth/server tokens (GITHUB_TOKEN)
• Google API keys (GOOGLE_API_KEY)
• AWS access key IDs (AWS_ACCESS_KEY)
• Slack tokens (SLACK_TOKEN)

Each match is replaced with [REDACTED:KIND] so the LLM still receives a semantically meaningful placeholder it can reason about.

Patterns are applied in order; more specific patterns (e.g. sk-ant-...) run before broader ones (sk-...) so the right label wins.

Customising patterns

Pass :patterns as a list of {Regex.t(), label} tuples to replace the defaults entirely:

{Condukt.Redactors.Regex, patterns: [{~r/internal-id-\d+/, "INTERNAL_ID"}]}

Or pass :extra_patterns to append to the defaults:

{Condukt.Redactors.Regex, extra_patterns: [{~r/cust_[a-z0-9]+/, "CUSTOMER"}]}