Tool
scrub
Strips credentials and personal data out of text before it leaves the repo.
Redact secrets and PII from a log, paste, or bug report before it leaves the repo — emails, AWS access keys, api_key/token/secret assignments, Bearer tokens, JWTs, IPv4 addresses, and PEM private-key blocks, each swapped for a typed placeholder like [REDACTED_AWS_KEY]. Reach for this whenever text you're about to share externally — an issue, a comment, a paste, a PR body, an error dump — might carry a credential or personal data. Never a slash command; use it implicitly when the intent calls for one.
What it does
scrub redacts secrets and PII from a log, paste, or bug report before it's shared. It swaps each match for a typed placeholder — emails become [REDACTED_EMAIL], AWS access keys [REDACTED_AWS_KEY], api_key=/token=/secret= assignments and Bearer tokens [REDACTED_TOKEN], JWTs [REDACTED_JWT], IPv4 addresses [REDACTED_IP], and PEM private-key blocks [REDACTED_PRIVATE_KEY] — so the shape of the redaction stays visible. It is pure standard library: no dependencies, no network, and the same input always produces the same cleaned output.
It is a tool, not a command: you never type it. The crew reach for it on their own whenever text is about to leave the repo — pasted into an issue, a bug report, a chat message, or a PR body — and might carry a credential or someone's personal data. The detectors are deliberately conservative, leaving ordinary prose and code identifiers like token = response.data.token alone, which makes it a strong first pass rather than a guarantee — read the cleaned text before sharing.
Examples
A few things scrub can produce, each from a small spec of its own. If you've set prefers-reduced-motion, any animation shows its final frame instead.
![Terminal recording of scrub redacting a log: an email, AWS key, bearer token, JWT and IP each replaced with a typed [REDACTED_*] placeholder, ending 'redacted 9 items across 7 categories'.](examples/scrub_poster.png)
In practice
What it does to a real input:
$ python3 scrub.py --in app.log
BEFORE
env AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
operator jane.doe@example.com from 203.0.113.42
Authorization: Bearer abcDEF0123456789xyzABCDEF
AFTER (summary on stderr)
env AWS_ACCESS_KEY_ID=[REDACTED_AWS_KEY]
operator [REDACTED_EMAIL] from [REDACTED_IP]
Authorization: Bearer [REDACTED_TOKEN]How the crew reach for it
Tools are opt-in. Add it at install time with shipmates install --harness <name> --with-tools scrub, or omit the flag and pick it from the interactive list. Once installed it sits alongside the crew as a capability they invoke implicitly; there is no slash command to type.
Run it on a file with python3 scrub.py --in log.txt --out clean.txt, or pipe text through it stdin-to-stdout with cat log.txt | python3 scrub.py. The cleaned text goes to --out or stdout; a per-category redaction summary goes to stderr so it never pollutes the output. Exit code is 0 on success and 2 on a usage error.
Reference
- Name
scrub- Description
- Redact secrets and PII from a log, paste, or bug report before it leaves the repo — emails, AWS access keys, api_key/token/secret assignments, Bearer tokens, JWTs, IPv4 addresses, and PEM private-key blocks, each swapped for a typed placeholder like [REDACTED_AWS_KEY]. Reach for this whenever text you're about to share externally — an issue, a comment, a paste, a PR body, an error dump — might carry a credential or personal data. Never a slash command; use it implicitly when the intent calls for one.
- Bundled files
scrub.py- Install
shipmates install --harness <name> --with-tools scrub
Where this lives
This page is generated from toolbox/scrub/tool.md. Opt in at install with --with-tools scrub and the installer copies the tool — instructions and bundled files — into the harness's skills tree.