Function redactSecrets

src/services/teamMemorySync/secretScanner.ts:312–324

(content: string)

let redactRules: RegExp[] | null = null

export function redactSecrets(content: string): string {
  redactRules ??= SECRET_RULES.map(
    r => new RegExp(r.source, (r.flags ?? '').replace('g', '') + 'g'),
  )
  for (const re of redactRules) {
    // Replace only the captured group, not the full match — patterns include
    // boundary chars (space, quote, ;) outside the group that must survive.
    content = content.replace(re, (match, g1) =>
      typeof g1 === 'string' ? match.replace(g1, '[REDACTED]') : '[REDACTED]',
    )
  }
  return content
}