scrub

scrub scans text for AWS keys, JWTs, PEM blocks, other vendors’ credential formats and generic high-entropy strings, and redacts them with length-matched replacements so diffs and formatting still line up.

It has a --check mode for pre-commit hooks and CI, and a Raycast extension on one shortcut that pastes a sanitised copy of the clipboard.

It’s the kind of project that only became worth starting once an agent could wrestle the Rust toolchain for me. I had a working version in an afternoon.