lenny-wasm

WebAssembly bindings for the Lenny secret redaction engine.

Runs in Node.js, browsers, Deno, and any WASM-capable runtime. No native compilation needed. Scans and redacts known secrets using BLAKE3 + rolling hash. Includes 216 built-in pattern rules.

Installation

npm install lenny-wasm

Usage

Exact-match redaction

import { Engine, PatternScanner } from 'lenny-wasm';

const engine = new Engine();
engine.loadSecrets([{ name: 'key', value: 'secret123' }]);

const result = engine.scan('the key is secret123');
console.log(result.output);        // "the key is [REDACTED:key]"
console.log(result.hasRedactions);  // true

Pattern scanning

const scanner = new PatternScanner();
const matches = scanner.scan('AWS_KEY=AKIAIOSFODNN7EXAMPLE');
console.log(matches[0].ruleId); // "aws-access-key"

Binary scanning

const redacted = engine.scanBytes(new Uint8Array([...]));

API

new Engine(opts?)

Creates a scanning engine. Options: { patterns: boolean } (default: true).

engine.loadSecrets(secrets)

Load secrets from an array of objects. Required: name (string), value (string).

Optional fields:

• tier: "log" (default), "alert", or "page"
• redaction: "tagged" (default), "full", or "partial"
• prefix / suffix: bytes for partial redaction (default: 4)
• canary: boolean (default: false)
• transformations: array of "base64" and/or "url"

engine.scan(input) -> ScanResult

Scan a string. Returns an object with:

• output (string) -- redacted output
• hasRedactions, hasCanaryHit, hasExactMatchRedactions (boolean)
• eventCount (number)
• events (array) -- secretName, tier, isCanary, byteOffset, matchedLen, contextSnippet, source

engine.scanBytes(Uint8Array) -> Uint8Array

Scan binary data. Returns redacted bytes only (no events).

new PatternScanner()

• scan(input) -- returns array of { ruleId, description, tier, start, end }
• ruleCount() -- returns number of loaded rules

Native Alternative

For maximum performance, use @zensre/lenny-napi (native addon, ~10x faster).

Full Documentation

See the Lenny project for configuration, deployment, threat model, and the complete list of pattern rules.

License

MIT