Secure-by-default redaction
Built-in and configurable patterns scrub recognized secrets from task arguments before transport.
Captured task arguments pass through a rule-based redaction engine before they leave the agent process, and z4j re-scrubs every event, exceptions included, on ingest. Built-in patterns cover common credential and PII shapes. The key and value patterns you configure apply at the agent on every engine, and Celery tasks also take per-task overrides for application-specific data.
The related dashboard view, captured with sample project data. Open the live demo to try it.
Ships with
- Recursive scrubber for nested dicts, lists and tuples; other objects are matched as text against value patterns
- Pattern matching: API keys, tokens, AWS access key IDs, private keys, nearly 60 built-in patterns
- RQ call strings: keyword arguments and dict keys named like secrets are redacted inside the job description
- Per-task overrides on Celery via @z4j_meta(redact_kwargs=[...])
- Brain-side re-scrub (defense in depth, does not trust agent)
Related