Secure-by-default redaction

Built-in and configurable patterns scrub recognized secrets before transport.

Task args, kwargs, return values, and exceptions pass through a rule-based redaction engine before leaving the agent process. Built-in patterns cover common credential and PII shapes; add operator patterns and per-task overrides for application-specific data. Defense-in-depth: z4j re-scrubs on ingest.

Preview

z4j overview view with sample project data — Dashboard overview · sample data. Explore the live demo →

Mockup of the dashboard view for this feature. Live-reloading and themed to match your dashboard.

Ships with

Recursive scrubber for nested dicts / lists / custom classes
Pattern matching: API keys, tokens, AWS creds, private keys, ~40 common patterns
Per-task overrides via @z4j_meta(redact_kwargs=[...])
Brain-side re-scrub (defense in depth, does not trust agent)