@zensre/lenny-napi

Native Node.js bindings for the Lenny secret redaction engine.

Scans and redacts known secrets using BLAKE3 + rolling hash (no secret values stored in memory at runtime). Includes 216 built-in pattern rules for detecting unknown secrets (API keys, tokens, connection strings).

Installation

npm install @zensre/lenny-napi

Requires Node.js 18+. Prebuilt binaries for Linux (x86_64, aarch64) and macOS (x86_64, aarch64).

Usage

Exact-match redaction

const { Engine, PatternScanner } = require('@zensre/lenny-napi');

const engine = new Engine();
engine.loadSecrets([{ name: 'db_pass', value: 'hunter2' }]);

const result = engine.scan('password is hunter2');
console.log(result.output.toString()); // "password is [REDACTED:db_pass]"
console.log(result.hasRedactions);      // true

Pattern scanning

const scanner = new PatternScanner();
const matches = scanner.scan('GITHUB_TOKEN=ghp_abc123def456ghi789jkl012mno345pqr678');
console.log(matches[0].ruleId);      // "github-pat"
console.log(matches[0].description); // "GitHub Personal Access Token"

Streaming with Transform

const { ScanTransform } = require('@zensre/lenny-napi');

const transform = new ScanTransform();
transform.engine.loadSecrets([{ name: 'key', value: 'secret123' }]);

process.stdin.pipe(transform).pipe(process.stdout);

API

new Engine(opts?)

Creates a scanning engine. Options: { patterns: boolean } (default: true).

engine.loadSecrets(secrets)

Load secrets from an array of objects. Required: name (string), value (string).

Optional fields:

• tier: "log" (default), "alert", or "page"
• redaction: "tagged" (default), "full", or "partial"
• redactionPrefix / redactionSuffix: bytes to show for partial (default: 4)
• canary: boolean (default: false)
• transformations: array of "base64" and/or "url"

engine.scan(input) -> ScanResult

Scan input (string or Buffer). Returns:

• output (Buffer) -- redacted output
• hasRedactions, hasCanaryHit, hasExactMatchRedactions (boolean)
• eventCount (number)
• events (RedactionEvent[]) -- secretName, tier, isCanary, byteOffset, matchedLen, contextSnippet, source

new PatternScanner()

• scan(input) -- returns PatternMatchResult[] with ruleId, description, tier, start, end
• ruleCount() -- returns number of loaded rules

WASM Alternative

For universal compatibility (browsers, serverless, any OS), see lenny-wasm.

Full Documentation

See the Lenny project for configuration, deployment, threat model, and the complete list of pattern rules.

License

MIT