har-sanitizer: share HTTP evidence without leaking secrets
Redact secrets and PII — cookies, JWT/bearer tokens, API keys, emails, Luhn-checked cards — from HAR, raw HTTP and curl before it goes into a report.
A bug report is only useful if it is reproducible, which means attaching real requests. But real requests carry cookies, bearer tokens, API keys and personal data that you must not hand over.
har-sanitizer strips those out of HAR files, raw HTTP and curl commands while keeping the request reproducible.
What it redacts
- Cookies and session identifiers.
- JWT / bearer tokens and API keys.
- Emails and other personal data.
- Card numbers, validated with a Luhn check to avoid false positives.
The result is evidence you can attach to a HackerOne or Bugcrowd report without a second thought.