Skip to main content
Snapshot probes capture every local variable in scope at the instrumented line. In practice, that scope often includes authentication headers, database credentials, API keys, and other sensitive values that should never appear in a debugging tool — even one only accessible to your own team. HyperProbe provides a built-in redaction system that replaces matched variable values with [REDACTED] before any data leaves the agent process. Redaction runs entirely inside your application, so sensitive data never reaches the backend or appears in the VS Code extension.

​
Default redacted keys

Out of the box, HyperProbe redacts any variable whose name matches one of the following strings (case-insensitive):
Key nameWhat it typically covers
passwordUser passwords, database passwords
secretGeneric secrets, client secrets
tokenAuth tokens, refresh tokens, JWT values
authorizationHTTP Authorization header values
cookieCookie strings
keyAPI keys, encryption keys
signatureHMAC signatures, signed values
These defaults apply without any configuration. You do not need to list them explicitly unless you are replacing the entire default list.
Redaction matches on variable names (keys), not on values. A variable named authHeader is not redacted by default; a variable named authorization is. Use redactValues to target specific values by content.

​
Adding custom keys

Pass an array of additional key names to redactKeys. Your list replaces the defaults, so include the default keys alongside any custom ones if you still want them redacted. 
import { HyperProbe } from '@hyperprobe/node-sdk';

HyperProbe.start({
  serviceId: 'my-service',
  environment: 'production',
  brokerUrl: 'grpc://broker.example.com:50051',
  commitSha: process.env.GIT_COMMIT,
  redactKeys: [
    // Keep the built-in defaults
    'password', 'secret', 'token', 'authorization', 'cookie', 'key', 'signature',
    // Add application-specific keys
    'apiKey', 'creditCard', 'ssn', 'privateKey', 'clientSecret',
  ],
});
Key matching is case-insensitive and matches exact variable names. A variable named userApiKey is not matched by the key apiKey — only an exact match on the full variable name is applied.

​
Redacting specific values

Use redactValues to redact variables whose value matches a specific string. This is useful for redacting known secrets like live Stripe keys or internal tokens that appear under different variable names depending on context. 
HyperProbe.start({
  serviceId: 'my-service',
  environment: 'production',
  brokerUrl: 'grpc://broker.example.com:50051',
  commitSha: process.env.GIT_COMMIT,
  redactKeys: ['password', 'secret', 'token', 'authorization', 'cookie', 'key', 'signature'],
  redactValues: [
    process.env.STRIPE_SECRET_KEY,  // e.g. 'sk_live_...'
    process.env.INTERNAL_API_TOKEN,
  ],
});
Any variable whose value exactly matches an entry in redactValues is replaced with [REDACTED] in the captured snapshot, regardless of the variable’s name.

​
Using environment variables

You can configure redaction without changing your code by using environment variables. This is useful for configuring different redaction rules across environments without a redeploy. 
HyperProbe.start({
  serviceId: 'my-service',
  environment: 'production',
  brokerUrl: 'grpc://broker.example.com:50051',
  commitSha: process.env.GIT_COMMIT,
  // redactKeys and redactValues are read from env if not set here
});
HYPERPROBE_REDACT_KEYS uses a comma as a separator. Key names that contain a comma are not supported via the environment variable. Use the redactKeys option in code if any of your key names include commas.

​
Best practices

Audit variable scope at probe locations. Before placing a probe, think about what variables are in scope at that line. In a request handler, req, res, and any middleware-attached properties are typically in scope. If req.headers.authorization is in scope, the authorization key is already redacted by default — but a custom property like req.context.stripeKey would not be unless you add it. Use conditions as a complement to redaction. The condition field on a probe restricts when a capture fires. You can combine redaction with a condition to limit captures to known-safe execution contexts: 
req.path === '/api/healthz'
user.role === 'internal'
process.env.NODE_ENV !== 'production'
Start with the defaults, then expand. The seven built-in keys cover the most common secrets. Add to the list as you identify application-specific fields — but avoid adding overly broad names (like data or value) that would redact useful debugging information. Prefer redactKeys over redactValues for structural secrets. If a sensitive value can appear under multiple variable names, listing it in redactValues is a safety net. However, redactKeys is more reliable because it catches a secret regardless of its current value, whereas redactValues requires an exact string match.