Custom sanitizer patterns (per site)¶
Patcherly ships a built-in list of secret-shaped patterns that every connector - and Patcherly itself - redacts before an error log line is stored or sent to the AI. That list catches the common cases: API keys, bearer tokens, common database passwords, PEM private-key blocks (OPENSSH / RSA / DSA / EC / PKCS#8 / ENCRYPTED), AWS / GitHub / Stripe / Slack tokens, and so on. You should not add custom patterns for any of those - they are already redacted by default.
For everything else specific to your stack - vendor tokens, internal account IDs, custom session cookies, project-specific secrets - you can add up to 32 of your own patterns per site. Patcherly applies them to every error as it arrives, on top of the built-in list.
The full pipeline runs in three passes: the connector redacts on your server before anything leaves, Patcherly re-runs the same built-in list as a defence-in-depth layer, and your custom patterns are applied last. You only need to manage the third pass - the other two are automatic.
When to use this¶
Add a custom pattern when all three are true:
- The string is secret-shaped - i.e. compromise of the value would actually harm a user (an internal user ID is not a secret; a session token is).
- It is not already caught by the hardcoded list. Open an error in your Errors page; if the value is showing up in the log line or traceback, it's not currently being redacted.
- The shape is regular enough to describe with a regex - a fixed prefix, a known length, or a known character class. If it looks like normal log text, a regex will redact half your logs too.
If you're not sure, don't add it: an overzealous redaction list will hide the very details the AI needs to suggest a correct fix.
Where to configure it¶
- Go to Sites → click the site you want to configure.
- Open the Sanitizer section.
- In Additional secret patterns, paste one Python
reregex per line. - Click Save. The patterns take effect immediately on the next detection - there is no connector restart and no propagation delay.
Format¶
- Language: Python
resyntax (same engine as your server). - Per pattern: ≤ 200 characters.
- Total: ≤ 32 patterns per site.
- One regex per line. Lines that are blank or whitespace-only are ignored.
The dashboard validates every pattern before saving. If even one entry fails to compile, the whole save is rejected and the textarea shows the bad entry - fix it and try again.
Examples¶
A few common shapes (replace with the strings you actually want to redact):
# Stripe restricted key
rk_(?:live|test)_[A-Za-z0-9]{24,}
# Internal vendor token: 8-char project prefix + 32 hex chars
ACME-[A-Z0-9]{8}-[a-f0-9]{32}
# Session cookie value (everything after the = up to ; or end)
session_id=[^;\s]+
# Customer-internal account UUID (only in specific log shapes)
account[_-]?id["':\s=]+[0-9a-f-]{36}
When a pattern matches, the matched text is replaced with [REDACTED_BY_TENANT_PATTERN]. Patcherly never echoes your pattern back into log output - only the placeholder - so an attacker who reads a redacted line cannot fingerprint your pattern list.
Limits¶
| Limit | Value |
|---|---|
| Patterns per site | 32 |
| Characters per pattern | 200 |
| Regex engine | Python re |
| Replacement token | [REDACTED_BY_TENANT_PATTERN] |
| Backreferences in replacement | not supported (single fixed token) |
| Applies to | log_line and traceback on every detection |
Pitfalls¶
- Greedy patterns redact too much.
.*will swallow everything from the first match to the end of the line. Anchor your regex to a literal prefix or use[^"]*/\S+instead of.*. - Patterns affect grouping, not just AI prompts. Once a pattern matches, the redacted form is what gets stored in MongoDB and what shows up in the dashboard. The original text is discarded - there is no "show me the raw line" toggle. Test on a sample before adding a pattern to a production site.
- Patterns do NOT apply to file content. They only run on the log line and traceback at detection. Code that the connector uploads as context goes through a separate sanitizer pipeline (the connector-side
sanitizer.py/.js/.php/.phpfor WordPress). - No retroactive sanitisation. Adding a pattern today does not redact errors that were detected yesterday - those rows stay as they were.
Removing a pattern¶
Delete the line from the textarea and click Save. To clear every extra pattern at once, empty the textarea and save. Patterns can also be edited freely - there is no version history on the list itself; the audit trail records every save with who made the change and when.
Related¶
- Security overview
- Privacy policy - what we redact and store.
- Path exclusion - exclude whole files from monitoring (different mechanism: paths, not regexes).
- Connectors overview - the connector-side sanitiser that runs first, before anything reaches Patcherly.