Package com.tnsai.quality.security

Class SecretFilter

java.lang.Object

com.tnsai.quality.security.SecretFilter

public final class SecretFilter
extends Object

Pre-LLM secret scrubbing filter.

Scans text for secret patterns (API keys, tokens, credentials, private keys, etc.) and replaces matches with [REDACTED:type] placeholders. Secrets never reach the LLM context.

Usage

 // Default filter with 50+ built-in patterns
 SecretFilter filter = SecretFilter.standard();
 String safe = filter.scrub("My key is sk-proj-abc123xyz");
 // safe == "My key is [REDACTED:openai_api_key]"

 // Custom filter
 SecretFilter custom = SecretFilter.builder()
     .addPattern(SecretPattern.of("my-secret", "MY_SECRET_\\w+", "custom"))
     .disablePattern("aws_secret_key")
     .build();
 

Since:

0.2.3

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	SecretFilter.Builder	Builder for configuring a SecretFilter.
static final record	SecretFilter.ScrubResult	Result of a scrub operation with metadata.

Method Summary

Modifier and Type	Method	Description
int	activePatternCount()	Returns the number of active patterns.
static SecretFilter.Builder	builder()	Creates a builder for configuring a SecretFilter.
boolean	containsSecrets(String text)	Checks if the text contains any detectable secrets.
List<SecretPattern>	getPatterns()	Returns all patterns (enabled and disabled).
String	scrub(String text)	Scrubs secrets from the given text.
SecretFilter.ScrubResult	scrubWithDetails(String text)	Scrubs secrets and returns a result with metadata.
static SecretFilter	standard()	Creates a standard filter with all built-in patterns enabled.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

standard

public static SecretFilter standard()

Creates a standard filter with all built-in patterns enabled.

Returns:

standard SecretFilter

builder

public static SecretFilter.Builder builder()

Creates a builder for configuring a SecretFilter.

Returns:

new builder

scrub

public String scrub(String text)

Scrubs secrets from the given text.

Parameters:

text - input text (may contain secrets)

Returns:

text with secrets replaced by placeholders

scrubWithDetails

public SecretFilter.ScrubResult scrubWithDetails(String text)

Scrubs secrets and returns a result with metadata.

Parameters:

text - input text

Returns:

scrub result with redacted text and detection info

containsSecrets

public boolean containsSecrets(String text)

Checks if the text contains any detectable secrets.

Parameters:

text - text to check

Returns:

true if secrets were detected

activePatternCount

public int activePatternCount()

Returns the number of active patterns.

Returns:

count of enabled patterns

getPatterns

public List<SecretPattern> getPatterns()

Returns all patterns (enabled and disabled).

Returns:

unmodifiable list of patterns