Redaction

Hansard redaction changes normalized text only. It does not redact raw provider backups, the optional reveal cache, binary attachments, or captured artifacts. It is pattern matching rather than semantic review, so unmatched secrets, identifiers, paths, and unrelated content can remain.

Redaction is not an approval to share

Review the full matched session before using Personal Sync, Teams, Slack, or a hosted viewer. A binary file or ordinary sentence can contain sensitive data without matching any redaction rule.

Default behavior

hansard init enables the built-in rules for new interactive setups unless --no-redaction is used. Outside that setup flow, redaction remains disabled until a configuration is created with hansard redact init.

Check the current state before importing sensitive history:

hansard redact status

The built-in detectors cover:

• AWS access key IDs;
• Anthropic and OpenAI API keys;
• GitHub and Slack tokens;
• JSON Web Tokens;
• PEM private keys; and
• high-entropy values assigned to environment-variable names containing words such as KEY, TOKEN, SECRET, or PASSWORD.

The rule names accepted by the CLI are aws_key, anthropic_key, openai_key, github_token, slack_token, jwt, private_key, and high_entropy_env.

Configure and preview rules

1. Create or enable the configuration.

   hansard redact init

   The configuration is written to ~/.hansard/redaction.yaml unless HANSARD_HOME points elsewhere.

2. Preview a synthetic sample without changing the archive.

   hansard redact test --text 'DEMO_SERVICE_TOKEN=0123456789abcdefghijklmnopqrstuvwxyzABCDEF'

   Preview still works when global redaction is disabled; the output makes that state explicit. Samples in preview output are masked.

3. Preview a file or one archived session when needed.

   hansard redact test --file ./synthetic-session.txt
   hansard redact test --session SESSION_ID

4. Import or reimport after the preview matches the intended boundary.

Customize redaction.yaml

The configuration supports individual built-ins, exact environment values, custom regular expressions, and repository allowlisting:

enabled: true

built_ins:
  jwt: false

env_vars:
  - DEMO_SERVICE_TOKEN

patterns:
  - name: synthetic_ticket
    regex: 'DEMO-[0-9]{4}'

allowlist_repos: []

Names under env_vars tell Hansard to read the corresponding value from the environment or a relevant .env file and replace that exact value in normalized text. The secret value is not written into redaction.yaml.

Custom regular expressions run after the built-ins. Test them against synthetic input before importing a large archive.

Repository allowlisting disables redaction

A repository listed under allowlist_repos bypasses every redaction rule for its normalized sessions. Use this only when retaining exact normalized text is more important than the protection redaction provides.

Toggle redaction

Enable or disable the whole subsystem:

hansard redact enable
hansard redact disable

Toggle one built-in while leaving the subsystem enabled:

hansard redact disable jwt
hansard redact enable jwt

Run hansard redact status after editing the YAML or changing a toggle.

Reapply rules to existing sessions

hansard redact reapply

Reapply is best-effort. It rewrites a writable local session only when Hansard has the unredacted reveal-cache copy needed to reconstruct its normalized records. Received read-only sessions, scoped web archives, and sessions without that cache are skipped and included in the reported skipped count.

Reapply does not modify:

• byte-preserved raw sources;
• attachment or artifact bytes;
• copies already uploaded to a remote destination;
• messages already posted to Slack; or
• provider-side originals and retention copies.

If source history still exists and parser behavior also changed, a clean provider reimport may be the more reliable recovery path.