Settings
Safe defaults, and how to move from dry-run to live.
Evidence. Unless tagged, statements on this page are covered by automated tests, not confirmed on a live site. Exceptions: confirmed on a test site in testing
Every value is checked when you save. Errors show next to the field.
Defaults
| Setting | Default | Notes |
|---|---|---|
| Dry-run | on | Detect and log only. Nothing is replaced or deleted. A banner shows dry-run or live. |
| Replace files even when no secrets are found | off | |
| Size limit (MB) | 25 | 1 to 100. Larger files are logged as skipped. |
| Extensions | har, json, log, txt, env | Optional: csv, yaml, yml, xml, conf, ini. |
| Email masking | mask all | Mask all, mask outside allowed domains, or do not mask. |
| Allowed email domains | none | Used by "outside allowed domains". |
| Extra header, query and form parameter names | none | Redacted in addition to the built-in lists. |
| Cookie names whose values are kept | none | By default every cookie value is redacted. Names are case-sensitive. |
| Allowlist (values never redacted) | none | Exact values. |
| Entropy detection | on | High-entropy strings next to words like token, secret, key. Turn off to reduce false positives. |
| Mask phone numbers | off | Produces more false positives. |
| Hash file names in the audit log | off | Stores a SHA-256 prefix instead of the name. |
| Audit retention (months) | 12 | 1 to 120. Older rows are deleted daily. The daily purge is covered by tests and has not been observed on a real site. |
Roll out in dry-run first
- Install. Dry-run is on and nothing is changed.
- Run the Leak audit (below) to see how many files hold secrets.
- Let normal traffic run for a few days in dry-run. Read the audit log: "Would sanitize" and "Verified clean".
- Review false positives. Add harmless values to the allowlist, or adjust email, entropy or cookie settings.
- Run the Permission check. Do not rely on removing a permission to stop the app: dry-run is the control that stops all changes.
- Turn dry-run off in a test project during low traffic. Upload a test file. Check that the sanitized copy exists, the preview renders, the original is gone and the audit row says "Sanitized". confirmed on a test site
- Watch the issue panel and audit log for "Failed: needs attention" for a week.
Existing attachments are not processed automatically when dry-run is switched off. Use "Sanitize flagged files now" for the ones dry-run flagged. confirmed on a test site
Deleted originals cannot be restored
There is no undo. confirmed on a test site
Leak audit
A read-only scan of up to 500 recent issues. It reports counts only, never values. Use it to see how many existing attachments hold secrets before you change anything. confirmed on a test site
Sanitize flagged files now
Processes attachments that dry-run logged as "Would sanitize" and that were never replaced.
- Dry-run must be off. With dry-run on, the action refuses to start: the Start button is disabled and a message says why. confirmed on a test site
- You type the number of files to confirm. Above 100 files you must also type
DELETE ORIGINALS. - The first run is a canary: it handles 5 files, then pauses. Inspect the results, then continue. Later runs do not pause. confirmed on a test site
- Cancel and Resume work. A run of 50 files was canceled after 13 and resumed, with no duplicates. A run of 12 files sanitized all of them. confirmed on a test site
- The result table lists the first 5 files only. The totals count every file. confirmed on a test site
- The pace is about 30 files per minute. This is a design limit, covered by automated tests only.
- Originals are permanently deleted for each processed file. confirmed on a test site
Also on the admin page
- Audit log with filters and CSV export. Columns: time, issue, attachment, file type, status, redaction count, rules, error code. No values. The CSV export is covered by automated tests only.
- Permission check. Read-only. It ran on a test project and reported nothing missing. confirmed on a test site Listing a permission that is really missing has not been seen. in testing
- License banner. Shows when the license is inactive. The banner is covered by automated tests only. With an inactive license, nothing is processed (seen on a test install). confirmed on a test site