tier-gated scrubbing.
100% where it counts.

deterministic detection for vendor secrets, structured ids, env vars, and contact data — locked in ci. not ai. not magic. just regex you can audit and a corpus that gates every deploy.

fail-closed consumers should block on scrub failure.

live demo

input

base eu tr medical

scrubbed output

(run demo)

decoded attestation jwt payload

(run demo)

rule packs

loaded live from /rules when available.

loading...

scrub text

curl -s -X POST https://scrubber.goku.codes/scrub?rules=base,tr \
  -H 'content-type: application/json' \
  -d '{"text":"call +90 532 555 1234 or jane@example.com. tc: 10000000146"}'

attestation lookup

curl -s https://scrubber.goku.codes/v1/attestations/<jti>

enterprise tier guarantees (v0.6.0)

deterministic detection, gated by a fixture corpus in CI. if any promised tier ever drops below 100%, the deploy fails — pre-deploy offline and post-deploy against this live host.

L1 vendor secrets — 100%. openai, anthropic, github pat (classic + fine-grained), stripe, slack, aws, google, hf, supabase, notion, linear, twilio, sendgrid, mailgun, postmark, shopify, square, heroku, digitalocean, npm, pypi, docker, gitlab, jwt, pem blocks.
L2 structured ids — 100%. credit cards (luhn-validated), ssn, ipv4.
L3 env-var sweep — 100%. NAME_KEY|TOKEN|SECRET|PASSWORD|... = value, including quoted values with spaces.
L4 contact — 100%. email and urls carrying token/key/secret/sig/auth/session params.
L5 free-form pii — best-effort. phone numbers and prose-only identifiers. add a rule pack or post-process for the cases your domain requires.

what it isn't