scrubPii() before the SDK ships it. Patterns run in a deliberate order (most specific first, multi-line first). Matched substrings are replaced with a tagged token.
Patterns
Regex source:
voight-sdk/src/privacy.ts.
Examples
Deliberate non-matches
To avoid false positives that would harm dev workflows:
The test suite at
tests/unit/privacy.test.ts verifies positive matches and adversarial negatives.
Properties
- Idempotent — re-running
scrubPii()on already-scrubbed text is stable. - Local — runs in the SDK subprocess on your machine; no network or filesystem I/O.
- Bounded — designed for a 2KB event payload in under 10ms on a modern laptop. Regexes are anchored with word boundaries to avoid catastrophic backtracking.
- Conservative — the pattern set is small (~13 regexes). Industry libraries like gitleaks, detect-secrets, and trufflehog ship 400+; we don’t.
Stricter than Standard
If Standard’s scrubbing isn’t strict enough for your case, Minimal drops content fields entirely:reasoning, errorMessage, input, metadata.detail, metadata.response_preview, metadata.responseText, metadata.cwd, metadata.git. What’s left is tool names, timings, token counts, and identifiers.
See the privacy overview capture-level table.