LOKI LogoLOKIv1.10.0

Network Scrubber

Automatic redaction of auth headers, cookies, tokens, API keys, and sensitive parameters in network.har.

What `NetworkScrubber` redacts

  • Sensitive headers (SENSITIVE_HEADERS): Authorization (keeping scheme prefix, e.g. Bearer [REDACTED]), Proxy-Authorization, Cookie, Set-Cookie, X-API-Key / apikey / api-key, X-Auth-Token, X-CSRF-Token, X-XSRF-Token, token, secret, and session.
  • Cookies: Every cookie value in HAR request and response cookies arrays is replaced with [REDACTED].
  • Raw tokens & keys in text (RAW_SENSITIVE_PATTERNS): Standard JWTs (ey...), Bearer tokens, PEM private keys (-----BEGIN ... PRIVATE KEY-----), and API keys with sk- (OpenAI), ghp_ (GitHub), or AIza (Google) prefixes.
  • Sensitive URL query params, form params & JSON keys (SENSITIVE_PARAM_PATTERNS): Keys matching token, api_key, secret, auth, password/passwd/pwd, session, jwt, access_token, refresh_token, id_token, cvv/cvc, card/credit_card, private_key, credential, passcode, pin, or ssn/social_security across URLs, postData, and JSON/base64 response bodies.

Always-on & fail-closed

NetworkScrubber runs automatically on every captured HAR with built-in rules (no external configuration required). If HAR sanitization fails, LOKI drops the archive instead of writing an unscrubbed network.har.

PreviousAuthorization GuardrailNextGitHub Actions CI