secrethider 0.1.0__tar.gz

secrethider-0.1.0/.clang-format

@@ -0,0 +1,3 @@
+BasedOnStyle: Google
+IndentWidth: 4
+ColumnLimit: 100

secrethider-0.1.0/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+[*.{yml,yaml,json,js}]
+indent_size = 2

secrethider-0.1.0/.gitignore

@@ -0,0 +1,22 @@
+build/
+out/
+dist/
+.venv/
+__pycache__/
+*.egg-info/
+*.pyd
+*.so
+*.dylib
+*.node
+node_modules/
+prebuilds/
+.cache/
+compile_commands.json
+.vs/
+.pytest_cache/
+.ruff_cache/
+
+# local secrets (registry tokens): never commit
+.env
+.env.*
+!.env.example

secrethider-0.1.0/.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+      - id: check-yaml
+      - id: check-json
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.0
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+  - repo: https://github.com/pre-commit/mirrors-clang-format
+    rev: v19.1.0
+    hooks:
+      - id: clang-format
+        types_or: [c++]

secrethider-0.1.0/.ubsan-ignorelist

@@ -0,0 +1,4 @@
+# UBSan ignore list for sanitizer builds: third-party sources are not ours to fix
+# (for example RE2 constructs a zero-length array at a null pointer). ASan still instruments everything.
+[undefined]
+src:*_deps*

secrethider-0.1.0/CMakeLists.txt

@@ -0,0 +1,51 @@
+cmake_minimum_required(VERSION 3.25)
+project(secrethider VERSION 0.1.0 LANGUAGES CXX)
+
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+set(CMAKE_CXX_VISIBILITY_PRESET hidden)
+set(CMAKE_VISIBILITY_INLINES_HIDDEN ON)
+
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+  set(CMAKE_BUILD_TYPE Release)
+endif()
+
+option(SECRETHIDER_BUILD_TESTS  "Build C++ unit tests"        ${PROJECT_IS_TOP_LEVEL})
+option(SECRETHIDER_BUILD_BENCH  "Build C++ benchmarks"        OFF)
+option(SECRETHIDER_BUILD_PYTHON "Build the Python extension"  OFF)
+option(SECRETHIDER_SANITIZE     "Enable ASan+UBSan (gcc/clang)" OFF)
+option(SECRETHIDER_BUILD_FUZZ   "Build the libFuzzer target (clang)" OFF)
+option(SECRETHIDER_WITH_RE2     "Custom regex rules via RE2 (pulls abseil)" ON)
+
+if(MSVC)
+  add_compile_options(/EHsc /utf-8)
+endif()
+
+if(SECRETHIDER_BUILD_TESTS)
+  enable_testing()
+endif()
+
+# Sanitizers must reach every target (static libraries need them at the final link, and the
+# dependencies should be instrumented too), so they are global rather than per target.
+if(SECRETHIDER_SANITIZE AND NOT MSVC)
+  add_compile_options(-fsanitize=address,undefined -fno-omit-frame-pointer)
+  add_link_options(-fsanitize=address,undefined)
+  if(CMAKE_CXX_COMPILER_ID MATCHES "Clang")
+    # third-party sources are not ours to fix (RE2 constructs a zero-length array at a null pointer)
+    add_compile_options(-fsanitize-ignorelist=${CMAKE_CURRENT_SOURCE_DIR}/.ubsan-ignorelist)
+  endif()
+endif()
+
+list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
+include(Warnings)
+include(Dependencies)
+
+add_subdirectory(core)
+
+if(SECRETHIDER_BUILD_PYTHON)
+  add_subdirectory(bindings/python)
+endif()
+# The Node addon is built by cmake-js from bindings/node/CMakeLists.txt.

secrethider-0.1.0/CMakePresets.json

@@ -0,0 +1,44 @@
+{
+  "version": 6,
+  "configurePresets": [
+    {
+      "name": "dev",
+      "displayName": "Dev (tests + bench, Release)",
+      "binaryDir": "${sourceDir}/build/dev",
+      "generator": "Ninja",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Release",
+        "SECRETHIDER_BUILD_TESTS": "ON",
+        "SECRETHIDER_BUILD_BENCH": "ON"
+      }
+    },
+    {
+      "name": "dev-msvc",
+      "displayName": "Dev with MSVC (Windows; run from a VS developer prompt)",
+      "inherits": "dev",
+      "binaryDir": "${sourceDir}/build/dev-msvc",
+      "cacheVariables": { "CMAKE_CXX_COMPILER": "cl", "CMAKE_C_COMPILER": "cl" },
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" }
+    },
+    {
+      "name": "asan",
+      "displayName": "Debug + ASan/UBSan (Linux/macOS)",
+      "inherits": "dev",
+      "binaryDir": "${sourceDir}/build/asan",
+      "cacheVariables": {
+        "CMAKE_BUILD_TYPE": "Debug",
+        "SECRETHIDER_BUILD_BENCH": "OFF",
+        "SECRETHIDER_SANITIZE": "ON"
+      }
+    }
+  ],
+  "buildPresets": [
+    { "name": "dev", "configurePreset": "dev" },
+    { "name": "dev-msvc", "configurePreset": "dev-msvc" },
+    { "name": "asan", "configurePreset": "asan" }
+  ],
+  "testPresets": [
+    { "name": "dev", "configurePreset": "dev", "output": { "outputOnFailure": true } },
+    { "name": "dev-msvc", "configurePreset": "dev-msvc", "output": { "outputOnFailure": true } }
+  ]
+}

secrethider-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NoobforAl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secrethider-0.1.0/Makefile

@@ -0,0 +1,148 @@
+# secrethider developer commands.  Run `make help`.
+#
+#   make fix     format + auto-fix lint: C++ (clang-format), Python (ruff), JavaScript/TypeScript (prettier)
+#   make test    build everything, run every test suite (C++, Python, Node), then the benchmarks
+#
+# Needs: cmake, ninja, a C++20 compiler, Python 3.9+ (uv is used when installed), Node 18+, clang-format.
+# Windows: GNU make with Git's sh. Visual Studio's C++ tools are found automatically (scripts/msvc-env.bat).
+
+.DEFAULT_GOAL := help
+
+# ---- platform ----------------------------------------------------------------------------------
+ifeq ($(OS),Windows_NT)
+  PRESET      ?= dev-msvc
+  VENV_BIN    := .venv/Scripts
+  EXE         := .exe
+  ENVRUN      := $(CURDIR)/scripts/msvc-env.bat
+  PYBUILD_ENV := CMAKE_GENERATOR=Ninja CC=cl CXX=cl
+  # the extensionless npm/npx are shell scripts that pick WSL's bash under Git's sh: use the .cmd shims
+  NPM         := npm.cmd
+  NPX         := npx.cmd
+  NODE_BUILD  := npx.cmd cmake-js compile -G Ninja --CDCMAKE_C_COMPILER=cl --CDCMAKE_CXX_COMPILER=cl
+else
+  PRESET      ?= dev
+  VENV_BIN    := .venv/bin
+  EXE         :=
+  ENVRUN      :=
+  PYBUILD_ENV := CMAKE_GENERATOR=Ninja
+  NPM         := npm
+  NPX         := npx
+  NODE_BUILD  := npx cmake-js compile
+endif
+
+# ---- tools -------------------------------------------------------------------------------------
+PYTHON       ?= python
+CLANG_FORMAT ?= clang-format
+HAVE_UV      := $(shell command -v uv 2>/dev/null)
+HAVE_RUFF    := $(shell command -v ruff 2>/dev/null)
+PY           := $(VENV_BIN)/python$(EXE)
+export UV_LINK_MODE := copy
+ifdef HAVE_UV
+  VENV_CREATE := uv venv .venv
+  PIP_INSTALL := uv pip install --python $(PY)
+else
+  VENV_CREATE := $(PYTHON) -m venv .venv
+  PIP_INSTALL := $(PY) -m pip install
+endif
+ifdef HAVE_RUFF
+  RUFF ?= ruff
+else ifdef HAVE_UV
+  RUFF ?= uv tool run ruff
+else
+  RUFF ?= $(PYTHON) -m ruff
+endif
+
+# ---- sources (tracked or untracked-but-not-ignored, so it works before the first commit) -------
+GIT_FILES = git ls-files --cached --others --exclude-standard
+CPP_FILES  := $(shell $(GIT_FILES) -- '*.cpp' '*.hpp' '*.h')
+SRC_CORE   := $(shell $(GIT_FILES) -- core cmake CMakeLists.txt)
+SRC_PY     := $(SRC_CORE) $(shell $(GIT_FILES) -- bindings/python pyproject.toml README.md)
+SRC_NODE   := $(SRC_CORE) $(shell $(GIT_FILES) -- bindings/node/src bindings/node/CMakeLists.txt bindings/node/package.json)
+
+BUILD_DIR    := build/$(PRESET)
+BENCH_FILTER ?= -Pathological
+
+NODE_DEPS  := bindings/node/node_modules/.installed
+NODE_ADDON := bindings/node/build/Release/secrethider.node
+PY_STAMP   := .venv/.installed
+
+.PHONY: help fix fix-cpp fix-python fix-js lint test check bench bench-full build \
+        test-core test-python test-node bench-core bench-python bench-node qa clean
+
+help: ## list the commands
+	@grep -E '^[a-zA-Z_-]+:.*## ' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*## "}; {printf "  make %-13s %s\n", $$1, $$2}'
+
+# ---- format / lint -----------------------------------------------------------------------------
+fix: fix-cpp fix-python fix-js ## format and auto-fix lint in place (C++, Python, JS/TS)
+
+fix-cpp:
+	$(CLANG_FORMAT) -i $(CPP_FILES)
+
+fix-python:
+	$(RUFF) check --fix bindings/python
+	$(RUFF) format bindings/python
+
+fix-js: $(NODE_DEPS)
+	cd bindings/node && $(NPX) prettier --write "lib/**/*.{js,ts}" "test/**/*.js" "qa/**/*.js" "bench/**/*.js"
+
+lint: $(NODE_DEPS) ## check formatting and lint without changing files (what CI should run)
+	$(CLANG_FORMAT) --dry-run --Werror $(CPP_FILES)
+	$(RUFF) check bindings/python
+	$(RUFF) format --check bindings/python
+	cd bindings/node && $(NPX) prettier --check "lib/**/*.{js,ts}" "test/**/*.js" "qa/**/*.js" "bench/**/*.js"
+
+# ---- build -------------------------------------------------------------------------------------
+build: ## configure and compile the C++ core, tests and benchmarks
+	$(ENVRUN) cmake --preset $(PRESET)
+	$(ENVRUN) cmake --build --preset $(PRESET)
+
+$(PY_STAMP): $(SRC_PY)
+	test -x $(PY) || $(VENV_CREATE)
+	$(PYBUILD_ENV) $(ENVRUN) $(PIP_INSTALL) --reinstall . pytest faker psutil
+	@touch $@
+
+$(NODE_DEPS): bindings/node/package.json
+	cd bindings/node && $(NPM) install --no-audit --no-fund
+	@touch $@
+
+$(NODE_ADDON): $(NODE_DEPS) $(SRC_NODE)
+	cd bindings/node && $(ENVRUN) $(NODE_BUILD)
+
+# ---- tests -------------------------------------------------------------------------------------
+test: test-core test-python test-node bench ## build, run all tests (C++, Python, Node), then the benchmarks
+
+check: test-core test-python test-node ## all tests, no benchmarks
+
+test-core: build
+	$(ENVRUN) ctest --preset $(PRESET)
+
+test-python: $(PY_STAMP)
+	$(PY) -m pytest -q
+
+test-node: $(NODE_ADDON)
+	cd bindings/node && $(NPM) test
+
+# ---- benchmarks --------------------------------------------------------------------------------
+bench: bench-core bench-python bench-node ## quick benchmarks for all three languages (BENCH_FILTER=. for everything)
+
+bench-full: ## include the adversarial-input benchmarks
+	$(MAKE) bench BENCH_FILTER=.
+
+bench-core: build
+	./$(BUILD_DIR)/core/secrethider_bench$(EXE) --benchmark_min_time=0.2s --benchmark_filter='$(BENCH_FILTER)'
+
+bench-python: $(PY_STAMP)
+	$(PY) bindings/python/bench/bench_redact.py
+
+bench-node: $(NODE_ADDON)
+	cd bindings/node && node bench/bench.js
+
+# ---- deeper checks -----------------------------------------------------------------------------
+qa: build $(PY_STAMP) $(NODE_ADDON) ## leak checks (C++, Python, Node) and a long randomized property run
+	./$(BUILD_DIR)/core/secrethider_leakcheck$(EXE) 3000
+	SECRETHIDER_PROP_ITERS=300000 ./$(BUILD_DIR)/core/secrethider_tests$(EXE) "property: random structured inputs keep all invariants"
+	$(PY) bindings/python/qa/leakcheck.py 3000
+	cd bindings/node && node --expose-gc qa/leakcheck.js 3000
+
+clean: ## remove build outputs and the Python venv
+	rm -rf build bindings/node/build .venv bindings/node/node_modules

secrethider-0.1.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.1
+Name: secrethider
+Version: 0.1.0
+Summary: Fast string and JSON processing backed by a C++ core (simdjson, simdutf)
+License: MIT
+Classifier: Programming Language :: C++
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Provides-Extra: faker
+Requires-Dist: faker>=24; extra == "faker"
+Description-Content-Type: text/markdown
+
+# secretHider
+
+Fast **secret redaction**, log processing, string and JSON tools: one C++20 core, thin bindings for Python and Node.js.
+
+- **Remove secrets from logs** in **plain text, logfmt and JSON lines**: AWS/GitHub/Slack/Stripe/Google keys, JWTs, PEM private keys, `Bearer` tokens, URL credentials, `password=...` fields, and optional PII (email, phone, card, SSN, IBAN, IPv4).
+- **Tell it what is secret** with plain lists: known values, field names and formats (or one `secrets.txt` file), on top of the built-in patterns.
+- **Choose what happens**: delete the whole field (`drop_field`), mask (full, typed, keep first/last N, preserve length, partial email/phone), stable salted hash, **realistic fake data via Faker** (Python `faker`, JS `@faker-js/faker`), or your own function. Partial masks never reveal more than 25% of a secret.
+- **Stream it**: chunk-safe redaction for files, pipes and sockets (output equals one-shot output at every split point), a `secrethider-redact` command line, and in-place/`.gz` file helpers.
+- **Fast**: about 600 MiB/s per core on clean logs, roughly 38x a hand-written Python `re` pipeline and comparable to V8's RegExp for a few simple patterns in Node ([numbers](docs/architecture/06-performance.md)). Built on [simdjson](https://github.com/simdjson/simdjson), [simdutf](https://github.com/simdutf/simdutf), [RE2](https://github.com/google/re2).
+- Also: `json_get` (JSON Pointer), `json_minify`, `json_valid`, UTF-8 helpers.
+
+```sh
+secrethider-redact --in-place --drop-fields --secrets-file secrets.txt app.log   # a=1 password=x b=2  ->  a=1 b=2
+secrethider-redact --pii --mask fake app.jsonl --json-lines                       # fake emails/phones instead of [REDACTED]
+```
+
+```python
+import secrethider
+from secrethider import Mask, RedactorBuilder
+
+r = (RedactorBuilder()
+     .enable("pii")
+     .secret_values(["my-known-secret"])       # also: secret_keys([...]), secret_formats([...])
+     .mask(Mask.keep_prefix(4))                # or Mask.drop_field(), secrethider.fake_mask(), ...
+     .build())
+
+r.redact("login password=hunter2hunter2hunter2 key=AKIAIOSFODNN7EXAMPLE")
+# 'login password=hunt**** key=AKIA****'
+# (short secrets fall back to a full mask: 4 revealed characters of a 10-character password would exceed 25%)
+
+# logging, files, streams
+from secrethider.logging import RedactingFormatter
+handler.setFormatter(RedactingFormatter(r, "%(levelname)s %(message)s"))
+secrethider.redact_file(open("in.log"), open("out.log", "w"), r)
+```
+
+```js
+const fk = require('secrethider');
+const r = new fk.RedactorBuilder().mask(fk.Mask.keepPrefix(4)).build();
+process.stdin.pipe(fk.createRedactStream(r)).pipe(process.stdout);
+```
+
+## Layout
+
+```
+core/              C++20 library (no Python/Node headers), tests, benchmarks
+bindings/python/   nanobind module + `secrethider` package (built via scikit-build-core, root pyproject.toml)
+bindings/node/     Node-API addon (node-addon-api + cmake-js)
+cmake/             shared CMake modules (dependencies, warnings)
+docs/              architecture: interfaces, log processing, rules and masking, builds, performance, security
+```
+
+## Documentation
+
+Start with the [guide to removing secrets from logs](docs/guides/removing-secrets-from-logs.md), or [docs/README.md](docs/README.md) for everything: [interfaces](docs/architecture/02-interfaces.md), [log processing pipeline](docs/architecture/03-log-processing.md),
+[rules and masking](docs/architecture/04-rules-and-masking.md), [build and platforms](docs/architecture/05-build-and-platforms.md),
+[performance](docs/architecture/06-performance.md), [security model](docs/architecture/07-security-model.md).
+
+## Develop
+
+```sh
+make fix     # format + auto-fix lint: C++ (clang-format), Python (ruff), JS/TS (prettier)
+make test    # build, run all tests (C++, Python, Node), then the benchmarks
+make help    # everything else: lint, check (tests only), bench, bench-full, qa (leak checks + long fuzz), clean
+```
+
+`make` finds Visual Studio's C++ tools on Windows by itself. Without `make`, the underlying steps are:
+
+```sh
+# C++ core: tests + benchmarks (Windows: use the dev-msvc preset from a VS developer prompt)
+cmake --preset dev && cmake --build --preset dev && ctest --preset dev
+./build/dev/core/secrethider_bench                  # secrethider_bench.exe on Windows
+
+# Python
+python -m venv .venv && . .venv/bin/activate    # Windows: .venv\Scripts\activate
+pip install . pytest faker && pytest
+
+# Node
+cd bindings/node && npm install && npm run build && npm test
+```
+
+`-DSECRETHIDER_WITH_RE2=OFF` skips RE2/abseil for a much faster build; custom `regex()` rules are then unavailable.
+
+## Cross-platform builds
+
+- Python wheels: `cibuildwheel` (Linux manylinux/musllinux, macOS x86_64 + arm64, Windows), stable-ABI (`abi3`) wheels, via `.github/workflows/release.yml`.
+- Node: Node-API is ABI-stable, so one binary per OS/arch; CI collects `prebuilds/<platform>-<arch>/secrethider.node`.
+- SIMD is selected at run time by simdjson/simdutf, so no `-march=native` and one binary runs fast everywhere.
+
+## Limits
+
+Redaction is defence in depth, not a guarantee: it finds known formats, sensitive key names and values you register. See the [security model](docs/architecture/07-security-model.md).
+
+## License
+
+MIT, see [LICENSE](LICENSE).

secrethider-0.1.0/README.md

@@ -0,0 +1,96 @@
+# secretHider
+
+Fast **secret redaction**, log processing, string and JSON tools: one C++20 core, thin bindings for Python and Node.js.
+
+- **Remove secrets from logs** in **plain text, logfmt and JSON lines**: AWS/GitHub/Slack/Stripe/Google keys, JWTs, PEM private keys, `Bearer` tokens, URL credentials, `password=...` fields, and optional PII (email, phone, card, SSN, IBAN, IPv4).
+- **Tell it what is secret** with plain lists: known values, field names and formats (or one `secrets.txt` file), on top of the built-in patterns.
+- **Choose what happens**: delete the whole field (`drop_field`), mask (full, typed, keep first/last N, preserve length, partial email/phone), stable salted hash, **realistic fake data via Faker** (Python `faker`, JS `@faker-js/faker`), or your own function. Partial masks never reveal more than 25% of a secret.
+- **Stream it**: chunk-safe redaction for files, pipes and sockets (output equals one-shot output at every split point), a `secrethider-redact` command line, and in-place/`.gz` file helpers.
+- **Fast**: about 600 MiB/s per core on clean logs, roughly 38x a hand-written Python `re` pipeline and comparable to V8's RegExp for a few simple patterns in Node ([numbers](docs/architecture/06-performance.md)). Built on [simdjson](https://github.com/simdjson/simdjson), [simdutf](https://github.com/simdutf/simdutf), [RE2](https://github.com/google/re2).
+- Also: `json_get` (JSON Pointer), `json_minify`, `json_valid`, UTF-8 helpers.
+
+```sh
+secrethider-redact --in-place --drop-fields --secrets-file secrets.txt app.log   # a=1 password=x b=2  ->  a=1 b=2
+secrethider-redact --pii --mask fake app.jsonl --json-lines                       # fake emails/phones instead of [REDACTED]
+```
+
+```python
+import secrethider
+from secrethider import Mask, RedactorBuilder
+
+r = (RedactorBuilder()
+     .enable("pii")
+     .secret_values(["my-known-secret"])       # also: secret_keys([...]), secret_formats([...])
+     .mask(Mask.keep_prefix(4))                # or Mask.drop_field(), secrethider.fake_mask(), ...
+     .build())
+
+r.redact("login password=hunter2hunter2hunter2 key=AKIAIOSFODNN7EXAMPLE")
+# 'login password=hunt**** key=AKIA****'
+# (short secrets fall back to a full mask: 4 revealed characters of a 10-character password would exceed 25%)
+
+# logging, files, streams
+from secrethider.logging import RedactingFormatter
+handler.setFormatter(RedactingFormatter(r, "%(levelname)s %(message)s"))
+secrethider.redact_file(open("in.log"), open("out.log", "w"), r)
+```
+
+```js
+const fk = require('secrethider');
+const r = new fk.RedactorBuilder().mask(fk.Mask.keepPrefix(4)).build();
+process.stdin.pipe(fk.createRedactStream(r)).pipe(process.stdout);
+```
+
+## Layout
+
+```
+core/              C++20 library (no Python/Node headers), tests, benchmarks
+bindings/python/   nanobind module + `secrethider` package (built via scikit-build-core, root pyproject.toml)
+bindings/node/     Node-API addon (node-addon-api + cmake-js)
+cmake/             shared CMake modules (dependencies, warnings)
+docs/              architecture: interfaces, log processing, rules and masking, builds, performance, security
+```
+
+## Documentation
+
+Start with the [guide to removing secrets from logs](docs/guides/removing-secrets-from-logs.md), or [docs/README.md](docs/README.md) for everything: [interfaces](docs/architecture/02-interfaces.md), [log processing pipeline](docs/architecture/03-log-processing.md),
+[rules and masking](docs/architecture/04-rules-and-masking.md), [build and platforms](docs/architecture/05-build-and-platforms.md),
+[performance](docs/architecture/06-performance.md), [security model](docs/architecture/07-security-model.md).
+
+## Develop
+
+```sh
+make fix     # format + auto-fix lint: C++ (clang-format), Python (ruff), JS/TS (prettier)
+make test    # build, run all tests (C++, Python, Node), then the benchmarks
+make help    # everything else: lint, check (tests only), bench, bench-full, qa (leak checks + long fuzz), clean
+```
+
+`make` finds Visual Studio's C++ tools on Windows by itself. Without `make`, the underlying steps are:
+
+```sh
+# C++ core: tests + benchmarks (Windows: use the dev-msvc preset from a VS developer prompt)
+cmake --preset dev && cmake --build --preset dev && ctest --preset dev
+./build/dev/core/secrethider_bench                  # secrethider_bench.exe on Windows
+
+# Python
+python -m venv .venv && . .venv/bin/activate    # Windows: .venv\Scripts\activate
+pip install . pytest faker && pytest
+
+# Node
+cd bindings/node && npm install && npm run build && npm test
+```
+
+`-DSECRETHIDER_WITH_RE2=OFF` skips RE2/abseil for a much faster build; custom `regex()` rules are then unavailable.
+
+## Cross-platform builds
+
+- Python wheels: `cibuildwheel` (Linux manylinux/musllinux, macOS x86_64 + arm64, Windows), stable-ABI (`abi3`) wheels, via `.github/workflows/release.yml`.
+- Node: Node-API is ABI-stable, so one binary per OS/arch; CI collects `prebuilds/<platform>-<arch>/secrethider.node`.
+- SIMD is selected at run time by simdjson/simdutf, so no `-march=native` and one binary runs fast everywhere.
+
+## Limits
+
+Redaction is defence in depth, not a guarantee: it finds known formats, sensitive key names and values you register. See the [security model](docs/architecture/07-security-model.md).
+
+## License
+
+MIT, see [LICENSE](LICENSE).

secrethider-0.1.0/bindings/node/CMakeLists.txt

@@ -0,0 +1,62 @@
+cmake_minimum_required(VERSION 3.25)
+cmake_policy(SET CMP0091 NEW)  # MSVC runtime selection (cmake-js)
+cmake_policy(SET CMP0042 NEW)  # macOS @rpath
+
+# npm's `rc` package installs node_modules/.bin/rc, which shadows the Windows
+# resource compiler (rc.exe) when cmake-js runs under npm. Drop .bin from PATH.
+if(WIN32)
+  set(_fk_path "$ENV{PATH}")
+  list(FILTER _fk_path EXCLUDE REGEX "node_modules[/\\\\]\\.bin")
+  set(ENV{PATH} "${_fk_path}")
+endif()
+
+project(secrethider_node LANGUAGES C CXX)
+
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+if(MSVC)
+  add_compile_options(/EHsc /utf-8)
+endif()
+set(CMAKE_CXX_VISIBILITY_PRESET hidden)
+set(CMAKE_VISIBILITY_INLINES_HIDDEN ON)
+if(NOT CMAKE_BUILD_TYPE)
+  set(CMAKE_BUILD_TYPE Release)
+endif()
+
+# Reuse the shared C++ core (this tree is built by cmake-js, not the top-level project).
+set(REPO_ROOT ${CMAKE_CURRENT_SOURCE_DIR}/../..)
+list(APPEND CMAKE_MODULE_PATH ${REPO_ROOT}/cmake)
+option(SECRETHIDER_WITH_RE2 "Custom regex rules via RE2 (pulls abseil)" ON)
+# cmake-js builds addons against the static MSVC runtime (/MT); abseil defaults to /MD.
+set(ABSL_MSVC_STATIC_RUNTIME ON CACHE BOOL "" FORCE)
+include(Warnings)
+include(Dependencies)
+add_subdirectory(${REPO_ROOT}/core ${CMAKE_BINARY_DIR}/core EXCLUDE_FROM_ALL)
+
+# Node-API (node-addon-api headers from node_modules)
+execute_process(COMMAND node -p "require('node-addon-api').include_dir"
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
+                OUTPUT_VARIABLE NODE_ADDON_API_DIR OUTPUT_STRIP_TRAILING_WHITESPACE)
+string(REPLACE "\"" "" NODE_ADDON_API_DIR "${NODE_ADDON_API_DIR}")
+
+add_library(secrethider_node SHARED src/addon.cpp src/redact.cpp ${CMAKE_JS_SRC})
+set_target_properties(secrethider_node PROPERTIES
+  PREFIX "" SUFFIX ".node" OUTPUT_NAME "secrethider"
+  # same location for Ninja and Visual Studio generators: build/Release/secrethider.node
+  RUNTIME_OUTPUT_DIRECTORY_RELEASE ${CMAKE_BINARY_DIR}/Release
+  LIBRARY_OUTPUT_DIRECTORY_RELEASE ${CMAKE_BINARY_DIR}/Release)
+target_include_directories(secrethider_node PRIVATE ${CMAKE_JS_INC} ${NODE_ADDON_API_DIR})
+target_link_libraries(secrethider_node PRIVATE secrethider::core ${CMAKE_JS_LIB})
+target_compile_definitions(secrethider_node PRIVATE NAPI_VERSION=8 NAPI_CPP_EXCEPTIONS)
+secrethider_set_warnings(secrethider_node)
+
+if(MSVC)
+  target_link_libraries(secrethider_node PRIVATE delayimp)  # needed by cmake-js's win_delay_load_hook
+endif()
+
+if(MSVC AND CMAKE_JS_NODELIB_DEF AND CMAKE_JS_NODELIB_TARGET)
+  execute_process(COMMAND ${CMAKE_AR} /def:${CMAKE_JS_NODELIB_DEF}
+                          /out:${CMAKE_JS_NODELIB_TARGET} ${CMAKE_STATIC_LINKER_FLAGS})
+endif()

secrethider-0.1.0/bindings/python/CMakeLists.txt

@@ -0,0 +1,6 @@
+nanobind_add_module(_core STABLE_ABI NB_STATIC src/module.cpp src/redact.cpp)
+target_link_libraries(_core PRIVATE secrethider::core)
+secrethider_set_warnings(_core)
+
+# Only the extension goes into the wheel (not simdjson/simdutf/re2/abseil headers or libs).
+install(TARGETS _core LIBRARY DESTINATION secrethider COMPONENT python_module)