>safelog
zero-dependency // stdlib only // one pipe

Keep secrets out of your AI agent's logs.

Safelog is a filter you drop into any pipe. It redacts API keys, tokens, private keys, emails, and IPs inline, one line at a time, so the stack trace you paste into Claude or Cursor never carries a live credential.

View on GitHub See it work
$ pip install "git+https://github.com/ctkrug/safelog"
app.log → safelog
$ tail -f app.log | safelog

What it does, and why it is different

Secret scanners like gitleaks and truffleHog scan a repo at rest in a batch job. Safelog does the other thing: it sits inline in a live pipe and redacts as bytes flow through, fast enough that a human or an agent on the other end never notices.

// streaming

Sits in the pipe, not in your way

Reads stdin and writes stdout as each line arrives, with flat memory use no matter how long the stream runs. Measured at 60 to 125ms of added latency per 1000 lines, so a live tail -f stays responsive.

// known shapes

Knows secrets by their shape

Regex detectors for AWS keys, GitHub, GitLab and Slack tokens, Stripe keys, JWTs, multi-line PEM private key blocks, emails, and IPv4/IPv6. It redacts only the secret and keeps the env var name and timestamp around it, so the log still reads.

// the long tail

Catches the ones with no name

A Shannon-entropy fallback flags high-entropy tokens that no pattern would recognize, like a generic API key or a password. It runs only where a regex found nothing, so it never double-redacts a match.

// auditable

Small enough to read and trust

Standard library only, no third-party dependencies. Vendor the package or install it in seconds. A tool that touches every byte of your logs should be short enough to read before you pipe secrets through it.

// modes

Redact your way

label names what was removed ([REDACTED:stripe-key]), mask hides even that (***), and hash gives a stable per-secret token so you can spot repeats without ever seeing the value.

// configurable

Tune it to your logs

Disable any detector, add custom named patterns from a safelog.toml, or move the entropy threshold. Safe defaults mean cmd | safelog is useful with zero configuration.

One command, secrets gone

The same five log lines before and after Safelog. Timestamps, log levels, and structure survive. Only the secret spans get replaced.

raw stream (secrets exposed)

2026-07-17T12:00:01Z INFO  starting worker pool=4
2026-07-17T12:00:02Z ERROR AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMIK7MDENGbP...
2026-07-17T12:00:03Z ERROR stripe key sk_test_NOTREALZZZ rejected
2026-07-17T12:00:04Z WARN  contact jane.doe@example.com about quota
2026-07-17T12:00:05Z INFO  client 10.0.4.212 connected

through safelog (secrets redacted)

2026-07-17T12:00:01Z INFO  starting worker pool=4
2026-07-17T12:00:02Z ERROR AWS_SECRET_ACCESS_KEY=[REDACTED:aws-secret]
2026-07-17T12:00:03Z ERROR stripe key sk_test_[REDACTED:stripe-key] rejected
2026-07-17T12:00:04Z WARN  contact [REDACTED:email] about quota
2026-07-17T12:00:05Z INFO  client [REDACTED:ip] connected

Install and use

No config needed to start. Add flags when you want to change modes or turn detectors off.

install

# install the CLI (Python 3.9+)
pip install "git+https://github.com/ctkrug/safelog"

# or run without installing, from a clone
PYTHONPATH=src python3 -m safelog < app.log

use it in a pipe

# live tail into an agent
tail -f app.log | safelog | claude

# scrub a command's output
some-cli --verbose 2>&1 | safelog

# mask instead of label; hide detector names
cat crash.txt | safelog --mode mask

# leave emails and IPs alone
safelog --disable email --disable ip

Questions

What is Safelog for?
Debugging with an AI agent now means piping your terminal, logs, or a crash dump into a model and asking what went wrong. That output often carries live secrets: a cloud key in a stack trace, a token from a .env that a debug print dumped, an internal IP, a customer email. Safelog sits between that output and the agent and redacts the secrets before they leave your machine. It also fits a screen-share, a support ticket, or anything you paste into chat.
How is it different from gitleaks or truffleHog?
Those tools scan files and git history at rest and produce a report. That is a batch job. Safelog is built for the streaming case instead: standard input in, standard output out, one line at a time, low enough latency to sit in a live | pipe without you noticing it. Different problem, different tool.
Will it slow down my terminal?
No. Safelog is line-oriented and only adds the cost of running its detectors over each line. Its own benchmark measures 60 to 125ms of added latency per 1000 lines on a mixed reference log, and the benchmark fails the build if that number goes past a stated budget.
What secrets does it catch?
Out of the box: AWS access keys and secret keys, GitHub, GitLab and Slack tokens, Stripe keys, JWTs, PEM private key blocks (collapsed across however many lines they span), email addresses, and IPv4/IPv6 addresses. A Shannon-entropy pass then flags high-entropy tokens with no known vendor shape, so a generic 32-character API key still gets caught. Run safelog --list-detectors to see every name.
Does it send my logs anywhere?
No. Safelog runs locally with the Python standard library and no third-party dependencies. It opens no network connections. The whole package is short enough to read start to finish before you trust it with a stream of secrets.