Scrubbing sensitive data

QuietGuard\Monitor\Support\Scrubber masks sensitive values by key before anything leaves the process. It is framework-agnostic and operates purely on arrays.

Configuring keys

Pass the terms you want masked to the constructor. They are stored lower-cased, and a key matches as soon as its name contains one of them, case-insensitively:

use QuietGuard\Monitor\Support\Scrubber;

$scrubber = new Scrubber(['password', 'authorization', 'api_key', 'secret']);

How it works

scrub(array $data): array walks the array recursively. When a key (a string key) contains one of the configured terms, its whole value is replaced with the mask constant; otherwise nested arrays are scrubbed in turn.

$clean = $scrubber->scrub([
    'user_id'  => 42,
    'password' => 'hunter2',
    'headers'  => [
        'Authorization' => 'Bearer abc',
        'Accept'        => 'application/json',
    ],
]);

// [
//   'user_id'  => 42,
//   'password' => '[scrubbed]',
//   'headers'  => [
//       'Authorization' => '[scrubbed]',   // matched case-insensitively
//       'Accept'        => 'application/json',
//   ],
// ]

Notes on the behaviour:

• The mask is the public constant Scrubber::MASK, which is '[scrubbed]'.
• Matching is on the key name, not the value: the scrubber does not pattern-match secrets inside string values.
• Matching is a case-insensitive substring check: the key name only has to contain a configured term, so a configured password also masks user_password and PASSWORD_CONFIRMATION.
• A matched key has its entire value masked, whether that value is a scalar or a nested array.
• Numeric/list keys are never treated as sensitive; only string keys are compared.

Where it is applied

The Reporter runs the scrubber automatically:

• reportException() scrubs the exception context before sending.
• sendLogs() scrubs the logs array before sending.
• sendDependencies() does not scrub: a dependency manifest contains package names and versions, not secrets.

If you build payloads yourself, call scrub() on the relevant array before handing it to a transport.

The other half: masking by shape

A key name never sees an address written into the free text of an error message, into a URL segment, or into a field somebody called reference. Support\ValueRedactor reads the value instead, and the Reporter runs it over the whole payload as the last thing before the wire, exceptions and logs alike.

It ships on, with email, iban, nir, card and phone. Shapes carrying a check digit are verified rather than merely matched, so a sixteen digit order reference is not taken for a card number, and each mask names what it hid ([redacted:email]) so the message stays readable. Configure it through Config: redact selects the shapes, customRedactions adds your own.