Replaces each secret value with [REDACTED], keeping its key.
Two rules apply, per the preventive-masking rule in
`logging-pii-guidlines.md` ยง1. Every value this process holds is masked
wherever it appears, with or without a key (see `SecretValues`). Any other
value after a secret key is masked, and the key is kept. Bare keywords are
kept, so `AuthenticationError` still reads as the error it is; only a key
followed by `=` or `:` loses its value. Both rules read the original text,
and where their stretches overlap the one that starts first is written
(see `MaskSpans`), so a held value that is part of a key, such as `secret`
in `client_secret`, cannot keep the key rule from masking what follows.
Parameters
text: string
Free text that may quote a credential, such as an error.
Replaces each secret value with
[REDACTED], keeping its key.Two rules apply, per the preventive-masking rule in `logging-pii-guidlines.md` ยง1. Every value this process holds is masked wherever it appears, with or without a key (see `SecretValues`). Any other value after a secret key is masked, and the key is kept. Bare keywords are kept, so `AuthenticationError` still reads as the error it is; only a key followed by `=` or `:` loses its value. Both rules read the original text, and where their stretches overlap the one that starts first is written (see `MaskSpans`), so a held value that is part of a key, such as `secret` in `client_secret`, cannot keep the key rule from masking what follows.