# Valstorm Secret Sanitizer (valstorm-sanitizer)

> Pure Python standard-library secret redaction engine that strips API keys, JWTs, database passwords, and environment secrets before logs or LLM prompts egress.

- **GitHub Repository:** https://github.com/Valstorm-Corp/valstorm-sanitizer
- **License:** PolyForm Noncommercial License 1.0.0 (https://polyformproject.org/licenses/noncommercial/1.0.0)
- **Installation:** `uv add git+https://github.com/Valstorm-Corp/valstorm-sanitizer`
- **Language/Stack:** Python 3.10+ (100% Pure Standard Library — Zero Dependencies)
- **Web Documentation:** https://www.valstorm.com/free-tools/valstorm-sanitizer

## Key Capabilities
- **Zero External Dependencies:** Built strictly on Python’s native re, os, pathlib, and typing modules so it can be embedded in any sandbox, CLI, or serverless worker with zero supply-chain risk.
- **Dynamic Environment Variable Redaction:** Automatically inspects os.environ for keys matching KEY, SECRET, TOKEN, PASSWORD, or DATABASE_URL and redacts their literal values anywhere they appear.
- **High-Precision Vendor Signatures:** Recognizes token formats for OpenAI, Anthropic, Google Gemini, AWS IAM, GitHub PATs, Slack tokens, Stripe live keys, Twilio, SendGrid, and JWTs.
- **Database Connection URI Scrubbing:** Redacts embedded credentials inside PostgreSQL, MongoDB, Redis, and AMQP connection strings while keeping hostnames readable for debugging.

## Quickstart
```bash
from valstorm_sanitizer import sanitize_text, sanitize_payload

# 1. Redact raw strings containing API keys, Bearer tokens, or DB URIs
clean_log = sanitize_text(
    "Connecting to postgres://admin:s3cr3tPass@db.internal:5432/prod with sk-proj-abc123xyz..."
)
# -> "Connecting to postgres://admin:<REDACTED_SECRET>@db.internal:5432/prod with <REDACTED_SECRET>..."

# 2. Recursively scrub nested dictionaries / LLM tool outputs before logging
safe_dict = sanitize_payload({
    "headers": {"Authorization": "Bearer eyJhbGciOiJIUzI1NiIs..."},
    "stripe_key": "sk_live_51N...",
})
```