Config Secret Scrubber

The failure mode this is built against isn’t a missed secret in an obviously-named field — it’s the unnamed one: a JWT sitting in a curl command, a password baked into a postgres:// connection string, a key name like jwt that doesn’t contain the word “secret” at all. Key-name matching alone misses all three, so standalone token-format detection runs as a second, independent pass over every line regardless of whether the key-based pass already redacted it.

It says so explicitly rather than implying certainty: the status line and the disclaimer both frame this as best-effort pattern matching, not a scan. A redaction tool that goes quiet about what it didn’t check is more dangerous than one that says “review this yourself.”