Valstorm Secret Sanitizer (valstorm-sanitizer)
Pure Python standard-library secret redaction engine that strips API keys, JWTs, database passwords, and environment secrets before logs or LLM prompts egress.
Prevent accidental credential leaks in AI agent trajectories, execution logs, and webhook payloads. valstorm-sanitizer has zero external dependencies, dynamically indexes sensitive os.environ values at runtime, matches high-entropy service signatures (OpenAI, Anthropic, Gemini, AWS, Stripe, GitHub, Slack, Twilio), and recursively scrubs nested dicts and JSON.
1. Redact Secrets from Strings, Logs, and Nested JSON Payloads
from valstorm_sanitizer import sanitize_text, sanitize_payload
# 1. Redact raw strings containing API keys, Bearer tokens, or DB URIs
clean_log = sanitize_text(
"Connecting to postgres://admin:[email protected]:5432/prod with sk-proj-abc123xyz..."
)
# -> "Connecting to postgres://admin:<REDACTED_SECRET>@db.internal:5432/prod with <REDACTED_SECRET>..."
# 2. Recursively scrub nested dictionaries / LLM tool outputs before logging
safe_dict = sanitize_payload({
"headers": {"Authorization": "Bearer eyJhbGciOiJIUzI1NiIs..."},
"stripe_key": "sk_live_51N...",
})
2. How valstorm-sanitizer Works Under the Hood
📝 Raw Tool Output / Log Line / Nested Dict / LLM Prompt
│
▼
🛡️ Valstorm Sanitizer (Zero External Dependencies)
├── Layer 1: Dynamic os.environ Secret Value Indexer
├── Layer 2: Service Prefix Signatures (OpenAI, Anthropic, AWS, Stripe, GitHub, Slack, Twilio)
├── Layer 3: Structural URI & Header Scrubbing (Bearer, Basic, postgres://, mongodb+srv://)
└── Layer 4: Recursive Dict / List / JSON Traversal
│
▼
✅ Sanitized Payload (<REDACTED_SECRET> / <REDACTED_ENV_SECRET>) 3. Core Capabilities & Technical Specifications
Zero External Dependencies
Built strictly on Python’s native re, os, pathlib, and typing modules so it can be embedded in any sandbox, CLI, or serverless worker with zero supply-chain risk.
Dynamic Environment Variable Redaction
Automatically inspects os.environ for keys matching KEY, SECRET, TOKEN, PASSWORD, or DATABASE_URL and redacts their literal values anywhere they appear.
High-Precision Vendor Signatures
Recognizes token formats for OpenAI, Anthropic, Google Gemini, AWS IAM, GitHub PATs, Slack tokens, Stripe live keys, Twilio, SendGrid, and JWTs.
Database Connection URI Scrubbing
Redacts embedded credentials inside PostgreSQL, MongoDB, Redis, and AMQP connection strings while keeping hostnames readable for debugging.
4. Open-Source & Commercial Licensing
PolyForm Noncommercial License 1.0.0
Free to clone, inspect, modify, and run for personal projects, educational study, and noncommercial research under the PolyForm Noncommercial License 1.0.0.
Valstorm Commercial License
Commercial use in business operations is included automatically with any active Valstorm BOS workspace ($25/mo in usage credits with $0/seat tax) or available via enterprise BYOC licensing.
5. Frequently Asked Questions
Why does valstorm-sanitizer have zero external dependencies?
Security primitives should never introduce third-party supply-chain vulnerabilities or version conflicts. Using only the Python standard library allows valstorm-sanitizer to run inside every Valstorm microservice, CLI, and sandbox.
Explore Other Valstorm Open-Source Packages
View All 7 Tools →Enterprise-grade autonomous AI execution runtime, ReAct loop, and parallel subagent swarm engine for developer workstations, CI pipelines, and remote team automation.
Command-line interface for Valstorm developers to authenticate via OAuth2 PKCE, pull and push object schemas as code, and manage local workspaces.
Stateless Streamable HTTP, SSE, and stdio Model Context Protocol (MCP) server exposing 16 granularly scoped Valstorm VFS, SQL, and CRM tools.
High-performance web scraping, domain crawling, RSS monitoring, and visual diff microservice with Python 3.14 native Zstandard compression.
Dedicated asynchronous microservice for multi-preset FFmpeg video transcoding, Deepgram/Whisper speech-to-text captions, and AI chapter generation.
Official typed Python 3.13+ SDK with 1:1 PlatformContext parity across records, SQL/GraphQL queries, VFS Knowledge Vaults, schemas, and sandboxes.