feat: add scrub command to remove credentials from AI CLI session logs by c0tton-fluff · Pull Request #24 · boostsecurityio/bagel

c0tton-fluff · 2026-02-21T08:39:34Z

Summary

Ports Python secret-scrubber as native bagel scrub command
24 regex patterns matching all credential types (SSH keys, AWS, GitHub, JWT, etc.)
Safe by default: dry-run unless --confirm is passed
Per-pattern prefix checks skip regexes when no prefix string appears
Concurrent file processing via errgroup
Byte-identical output vs Python scrubber (verified on real session data)
CLA signed

Usage

bagel scrub # dry run
bagel scrub --confirm # apply redactions
bagel scrub --confirm --grace-minutes 0 # include recent files
bagel scrub --file --confirm # single file

Files added

pkg/scrubber/patterns.go - 24 compiled regex patterns with prefix strings
pkg/scrubber/scrubber.go - core logic with prefix check + concurrency
pkg/scrubber/scrubber_test.go - table-driven tests for every pattern
cmd/bagel/scrub.go - Cobra command wiring
CLA_SIGNATURES.md - signed CLA

Test plan

go test -race ./pkg/scrubber/... -- 14 test functions, all pass
go vet ./... -- clean
Full project test suite -- zero regressions
Parity: byte-identical MD5 vs Python scrubber on real session data
Performance: 1912 files in 15s with concurrency + prefix optimization

Closes #22

- Run() and FindEligibleFiles() accept context.Context as first param (CTX-1/CTX-2) - Replace context.Background() with caller's context in errgroup - Extract logger via zerolog.Ctx(ctx) instead of passing via RunInput struct - Log filepath.Walk errors instead of silently swallowing them

c0tton-fluff · 2026-02-21T11:05:09Z

Pushed a follow-up commit fixing three issues from code review:

Context propagation -- Run() and FindEligibleFiles() now accept context.Context as first param, replacing context.Background() with the caller's context (CTX-1/CTX-2)
Silent walk errors -- filepath.Walk callback now logs unreadable entries via log.Warn() instead of silently returning nil
Logger pattern -- Removed Logger from RunInput struct, now extracted from context via zerolog.Ctx(ctx) to match the rest of the codebase

All tests pass with -race, go vet clean.

… history targets

c0tton-fluff · 2026-02-21T14:13:51Z

Pushed UX overhaul after having a quick chat with François before Monday's review.

Interactive prompt - Running bagel scrub with no flags now shows what would be scrubbed and asks for confirmation, instead of requiring --confirm. Safer default UX.
Shell history support - Scrub now targets ~/.bash_history and ~/.zsh_history in addition to AI CLI session logs (Claude Code, Codex, Cursor).
Flag rename - --confirm replaced with --yes (skip prompt) and --dry-run (preview only), matching standard CLI conventions (apt, terraform, etc.).
README updated - Scrub section reflects new flags and shell history targets.

All tests pass with -race, linter clean. Hope all is well and you had a good weekend!

SUSTAPLE117 · 2026-02-23T21:16:06Z

pkg/scrubber/scrubber.go

@@ -0,0 +1,351 @@
+// Copyright (C) 2026 boostsecurity.io


@c0tton-fluff this is reimplementing a lot of the existing flow that bagel uses to detect secrets in those locations. We should leverage existing scanning capabilities instead of reimplementing everything like this

Hey @SUSTAPLE117

Apologies for late reply, it has been a super busy week. I am looking into it and realising my mistake at the original approach. I will refactor and rework it so it is much, much better and I hope to contribute in best way! 💪 🧠

@c0tton-fluff no worries your contribution is very much appreciated!

Addresses PR boostsecurityio#24 feedback: scrubber no longer reimplements file discovery and secret detection. Each detector now implements an optional Redactor interface. The scrubber becomes a thin orchestration layer that calls registry.RedactAll(). - Add Redactor interface + RedactAll to detector.Registry - Add Redact() method to all 8 existing detectors - Create SplunkTokenDetector (new, covers splunkd_ tokens) - Extend CloudCredentialsDetector with AWS session/secret patterns - Delete pkg/scrubber/patterns.go (patterns now live in detectors) - Refactor scrubber to accept *detector.Registry - Wire up cmd/bagel/scrub.go with newScrubRegistry()

SUSTAPLE117 · 2026-03-03T19:14:53Z

pkg/scrubber/scrubber.go

+// FindEligibleFiles walks known AI CLI paths and returns files older
+// than graceMins minutes. Files modified within the grace period are
+// skipped to avoid interfering with active sessions.
+func FindEligibleFiles(ctx context.Context, graceMins int) ([]string, error) {


Bagel already builds when scanning a File Index of all the interesting files we look for. It's based on that file index that detections are done when running the scanning so you don't need to reimplement this here. The redact command should piggy back on the existing file index and scanning

SUSTAPLE117 · 2026-03-03T19:15:14Z

pkg/scrubber/scrubber.go

+// sessionDirs lists known AI CLI session log and shell history
+// locations relative to $HOME. An empty RelPath means files live
+// directly in $HOME (matched by name, not walked recursively).
+var sessionDirs = []sessionDir{


Those should be added to the file index

SUSTAPLE117 · 2026-03-03T19:16:31Z

pkg/scrubber/scrubber.go

+
+// Scan finds eligible files and counts what would be redacted.
+// It never writes to disk.
+func Scan(ctx context.Context, input ScanInput) (ScanResult, error) {


As mentionned the existing scanning in Bagel should be leveraged to do this. The scrubbing should be something done after file index is built and bagel has scanned for findings and then we scrub the values found per finding that can be scrubbed

Mike-clst · 2026-03-03T20:35:18Z

On it! I will rewrite what is needed. 😃

…iscovery

SUSTAPLE117 · 2026-03-04T21:13:37Z

@c0tton-fluff lgtm just need to fix the test on windows

feat: add scrub command to remove credentials from AI CLI session logs

b881fff

c0tton-fluff force-pushed the feat/scrub-command branch from 7ec595d to b881fff Compare February 21, 2026 09:52

c0tton-fluff added 2 commits February 21, 2026 13:29

feat: scrub UX overhaul - interactive prompt, shell history, flag rename

453fc11

docs: update README scrub section for --yes/--dry-run flags and shell…

4922506

… history targets

SUSTAPLE117 reviewed Feb 23, 2026

View reviewed changes

c0tton-fluff added 3 commits February 25, 2026 21:20

fix: resolve prealloc lint warnings across probes and detector

e4119b2

fix: set USERPROFILE in tests for Windows os.UserHomeDir

92d5f5b

SUSTAPLE117 reviewed Mar 3, 2026

View reviewed changes

refactor: scrub reuses scan pipeline instead of reimplementing file d…

d5d1711

…iscovery

fproulx-boostsecurity requested a review from SUSTAPLE117 March 4, 2026 18:00

windows fix - added runtime import + t.Skip on Windows

260f54a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add scrub command to remove credentials from AI CLI session logs#24

feat: add scrub command to remove credentials from AI CLI session logs#24
c0tton-fluff wants to merge 9 commits intoboostsecurityio:mainfrom
c0tton-fluff:feat/scrub-command

c0tton-fluff commented Feb 21, 2026

Uh oh!

c0tton-fluff commented Feb 21, 2026

Uh oh!

c0tton-fluff commented Feb 21, 2026

Uh oh!

SUSTAPLE117 Feb 23, 2026

Uh oh!

c0tton-fluff Feb 25, 2026

Uh oh!

SUSTAPLE117 Feb 27, 2026

Uh oh!

SUSTAPLE117 Mar 3, 2026

Uh oh!

SUSTAPLE117 Mar 3, 2026

Uh oh!

SUSTAPLE117 Mar 3, 2026

Uh oh!

Mike-clst commented Mar 3, 2026 •

edited

Loading

Uh oh!

SUSTAPLE117 commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

c0tton-fluff commented Feb 21, 2026

Summary

Usage

Files added

Test plan

Uh oh!

c0tton-fluff commented Feb 21, 2026

Uh oh!

c0tton-fluff commented Feb 21, 2026

Uh oh!

SUSTAPLE117 Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

c0tton-fluff Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

SUSTAPLE117 Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

SUSTAPLE117 Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

SUSTAPLE117 Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

SUSTAPLE117 Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Mike-clst commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SUSTAPLE117 commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Mike-clst commented Mar 3, 2026 •

edited

Loading