Secret Guard Reporter

A Playwright reporter that automatically scrubs sensitive values (secrets, tokens, private keys) from all test output before it reaches other reporters or is written to disk.

Install

yarn add @lidofinance/secret-guard-reporter

Usage

Use as the only top-level reporter and list all other reporters inside the reporters option. SecretGuard scrubs every piece of data before forwarding it to the inner reporters, and scrubs the report directory at the end of the run.

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  reporter: [
    [
      '@lidofinance/secret-guard-reporter',
      {
        sensitiveEnvKeys: ['WALLET_SECRET_PHRASE', 'WALLET_PASSWORD'],
        reporters: [
          ['html', { open: 'never' }],
          ['list'],
        ],
      },
    ],
  ],
});

Options

| Option | Type | Required | Default | Description | |--------------------|-------------------|----------|-----------------------|-------------| | sensitiveEnvKeys | string[] | ✅ | — | Env variable names whose runtime values will be redacted everywhere. | | reporters | [string, any?][]| — | [] | Inner reporters to wrap. Supports all built-in Playwright reporter names and third-party paths. | | reportDir | string | — | 'playwright-report' | Directory to scrub after the run (HTML report, traces, etc.). |

How it works

1. During tests — onStdOut/onStdErr scrub real-time output chunks before forwarding to inner reporters. onTestEnd scrubs stdout, stderr, error messages, stack traces, and attachment files in-place, then forwards the clean data.

2. After all tests — onEnd awaits each inner reporter's onEnd (so the HTML reporter finishes writing its files first), then scrubs every text-based file in reportDir and re-encodes any base64-embedded ZIP trace archives found in index.html.

Scrubbed surfaces:

• Real-time stdout / stderr stream chunks
• stdout / stderr chunks in TestResult
• Error messages and stack traces
• Text-based attachment files (.html, .json, .txt, .log, .har, .md, .xml)
• ZIP trace archives (.zip attachments)
• All text-based files in reportDir after the run
• Base64-embedded ZIPs inside reportDir/index.html

reportDir should match the outputFolder of your HTML reporter (or wherever Playwright writes its report). Defaults to 'playwright-report'. Set it explicitly if you use a custom path:

['@lidofinance/secret-guard-reporter', {
  sensitiveEnvKeys: ['WALLET_SECRET_PHRASE'],
  reportDir: 'my-custom-report',
  reporters: [['html', { outputFolder: 'my-custom-report' }]],
}]

Safety: Values shorter than 5 characters are ignored to avoid false positives.

License

MIT