[P2] Audit: Log Scrubber redaction coverage needs a documented rule matrix and tests

[baixiangcpp]

Imported from the byteflow.tools deep audit on 2026-06-22.

Problem: Log Scrubber is high-trust because users may use it before sharing incident evidence. It should have a documented redaction rule matrix and automated tests covering common sensitive patterns.

Affected URL:

• https://byteflow.tools/en/log-scrubber

Reproduction steps:

1. Open Log Scrubber.
2. Paste dummy logs containing email addresses, IPv4 addresses, bearer tokens, JWT-like strings, API-key-looking values, cookies, URL credentials, AWS-key-like strings, private-key-like blocks, and environment variable secrets.
3. Run scrubbing.
4. Compare output and diff view.
5. Check which patterns are documented.

Expected behavior: the tool should clearly document supported redaction classes, known limitations, and verification steps.

Actual behavior: the tool promises redaction, but a visible rule matrix and exhaustive tests should be added or surfaced.

Impact: users may overtrust automated redaction and share logs that still contain sensitive data.

Proposed fix:

• Add a rule coverage matrix in docs and optionally in the tool UI.
• Add automated tests for common secret/PII patterns.
• Add a warning that manual review is still required.
• Add customizable redaction toggles where safe.
• Add a final review checklist before copying/download.

Acceptance criteria:

• Redaction coverage matrix is documented.
• Automated tests cover common token, credential, email, IP, cookie, and key patterns.
• Tool clearly states it cannot guarantee complete redaction.
• Output diff highlights every redacted region.

[baixiangcpp]

Closed as completed by the canonical BF audit backlog work. This older non-BF audit issue duplicates work now merged through PRs #209-#219, with the BF issues closed and guard/test coverage in place. The remaining non-duplicate follow-up is #7, which stays open because the upstream Next/PostCSS advisory is not fixed yet.