Redact Config

The redact command supports YAML configuration for complex redaction rules.

Basic Structure

# Global settings
seed: 12345
locale: en

# Default strategy for unmatched columns
# (note the nested `strategy` key)
defaults:
  strategy:
    strategy: skip

# Column-specific rules
rules:
  - column: "*.email"
    strategy: hash
  - column: "*.name"
    strategy: fake
    generator: name

# Tables to skip entirely
skip_tables:
  - schema_migrations
  - ar_internal_metadata

Global Settings

seed

Random seed for reproducible fake data generation:

seed: 12345

Same seed = same fake data on every run.

locale

Locale for fake data generation:

locale: en # English (default)
locale: de_de # German
locale: fr_fr # French
locale: ja_jp # Japanese
locale: zh_cn # Chinese

Rules

Each rule matches columns and applies a strategy.

Column Patterns

rules:
  # All columns named 'email' in any table
  - column: "*.email"

  # Specific table.column
  - column: "users.password"

  # Wildcard in column name
  - column: "*.ssn*"

For a schema-qualified table, put the complete table identity before the final column separator. For example, tenant_a.users.email targets the email column in tenant_a.users.

Each rule takes a single glob pattern. To match multiple patterns, use one rule per pattern:

rules:
  - column: "*.phone"
    strategy: fake
    generator: phone
  - column: "*.mobile"
    strategy: fake
    generator: phone

Strategies

null

Replace with NULL:

- column: "*.ssn"
  strategy: "null"

The quotes are required—unquoted null is a YAML null value and fails to parse.

constant

Replace with a fixed value:

- column: "*.status"
  strategy: constant
  value: "REDACTED"

hash

SHA256 hash (deterministic):

- column: "*.email"
  strategy: hash

Same input always produces same hash, preserving FK relationships.

Optionally keep the email domain (user@domain.com → hash@domain.com):

- column: "*.email"
  strategy: hash
  preserve_domain: true

fake

Generate realistic fake data:

- column: "*.name"
  strategy: fake
  generator: name

Available generators:

Generator	Example Output
`email`	`jessica.smith@example.com`
`name`	`Robert Johnson`
`first_name`	`Sarah`
`last_name`	`Williams`
`phone`	`+1 (555) 234-5678`
`address`	`123 Oak Street, Springfield, IL`
`city`	`Portland`
`state`	`California`
`zip`	`90210`
`country`	`United States`
`company`	`Acme Corporation`
`job_title`	`Software Engineer`
`username`	`jsmith42`
`url`	`https://example.com/page`
`ip`	`192.168.1.100`
`ipv6`	`2001:db8::1`
`uuid`	`550e8400-e29b-41d4-...`
`date`	`1985-07-23`
`datetime`	`2023-01-15 14:30:00`
`credit_card`	`4532015112830366`
`iban`	`DE89370400440532013000`
`ssn`	`123-45-6789`
`lorem`	`Lorem ipsum dolor sit...`
`paragraph`	`Full paragraph of text...`
`sentence`	`A complete sentence.`

mask

Partial masking with pattern:

- column: "*.credit_card"
  strategy: mask
  pattern: "****-****-****-XXXX"

Pattern symbols:

* - Replace with asterisk
X - Keep original character
# - Random digit

Examples:

****-****-****-XXXX → ****-****-****-1234
XXX-XX-#### → 123-45-6789 (SSN with random last 4)
***@XXXXX → ***@gmail.com (mask email prefix)

shuffle

shuffle configuration is rejected. Correct shuffling requires a two-pass rewrite so the output never retains the original value at its source row.

skip

No redaction (passthrough):

- column: "admins.email"
  strategy: skip

skip_tables

Skip entire tables from redaction:

skip_tables:
  - schema_migrations
  - ar_internal_metadata
  - _global

Complete Example

seed: 42
locale: en

defaults:
  strategy:
    strategy: skip

rules:
  # PII
  - column: "*.email"
    strategy: hash
  - column: "*.name"
    strategy: fake
    generator: name
  - column: "*.first_name"
    strategy: fake
    generator: first_name
  - column: "*.last_name"
    strategy: fake
    generator: last_name
  - column: "*.phone"
    strategy: fake
    generator: phone
  - column: "*.mobile"
    strategy: fake
    generator: phone
  - column: "*.ssn"
    strategy: "null"
  - column: "*.password"
    strategy: constant
    value: "$2a$10$REDACTED"

  # Financial
  - column: "*.credit_card"
    strategy: mask
    pattern: "****-****-****-XXXX"
  # Addresses
  - column: "*.address"
    strategy: fake
    generator: address
  - column: "*.city"
    strategy: fake
    generator: city
  - column: "*.zip"
    strategy: fake
    generator: zip
  - column: "*.postal_code"
    strategy: fake
    generator: zip

  # Exceptions
  - column: "admins.email"
    strategy: skip

skip_tables:
  - schema_migrations
  - ar_internal_metadata