Skip to content

Custom sanitizer patterns (per site)

Patcherly ships a built-in list of secret-shaped patterns that every connector - and Patcherly itself - redacts before an error log line is stored or sent to the AI. That list catches the common cases: API keys, bearer tokens, common database passwords, PEM private-key blocks (OPENSSH / RSA / DSA / EC / PKCS#8 / ENCRYPTED), AWS / GitHub / Stripe / Slack tokens, and so on. You should not add custom patterns for any of those - they are already redacted by default.

For everything else specific to your stack - vendor tokens, internal account IDs, custom session cookies, project-specific secrets - you can add up to 32 of your own patterns per site. Patcherly applies them to every error as it arrives, on top of the built-in list.

The full pipeline runs in three passes: the connector redacts on your server before anything leaves, Patcherly re-runs the same built-in list as a defence-in-depth layer, and your custom patterns are applied last. You only need to manage the third pass - the other two are automatic.

When to use this

Add a custom pattern when all three are true:

  1. The string is secret-shaped - i.e. compromise of the value would actually harm a user (an internal user ID is not a secret; a session token is).
  2. It is not already caught by the hardcoded list. Open an error in your Errors page; if the value is showing up in the log line or traceback, it's not currently being redacted.
  3. The shape is regular enough to describe with a regex - a fixed prefix, a known length, or a known character class. If it looks like normal log text, a regex will redact half your logs too.

If you're not sure, don't add it: an overzealous redaction list will hide the very details the AI needs to suggest a correct fix.

Where to configure it

  1. Go to Sites → click the site you want to configure.
  2. Open the Sanitizer section.
  3. In Additional secret patterns, paste one Python re regex per line.
  4. Click Save. The patterns take effect immediately on the next detection - there is no connector restart and no propagation delay.

Format

  • Language: Python re syntax (same engine as your server).
  • Per pattern: ≤ 200 characters.
  • Total: ≤ 32 patterns per site.
  • One regex per line. Lines that are blank or whitespace-only are ignored.

The dashboard validates every pattern before saving. If even one entry fails to compile, the whole save is rejected and the textarea shows the bad entry - fix it and try again.

Examples

A few common shapes (replace with the strings you actually want to redact):

# Stripe restricted key
rk_(?:live|test)_[A-Za-z0-9]{24,}

# Internal vendor token: 8-char project prefix + 32 hex chars
ACME-[A-Z0-9]{8}-[a-f0-9]{32}

# Session cookie value (everything after the = up to ; or end)
session_id=[^;\s]+

# Customer-internal account UUID (only in specific log shapes)
account[_-]?id["':\s=]+[0-9a-f-]{36}

When a pattern matches, the matched text is replaced with [REDACTED_BY_TENANT_PATTERN]. Patcherly never echoes your pattern back into log output - only the placeholder - so an attacker who reads a redacted line cannot fingerprint your pattern list.

Limits

Limit Value
Patterns per site 32
Characters per pattern 200
Regex engine Python re
Replacement token [REDACTED_BY_TENANT_PATTERN]
Backreferences in replacement not supported (single fixed token)
Applies to log_line and traceback on every detection

Pitfalls

  • Greedy patterns redact too much. .* will swallow everything from the first match to the end of the line. Anchor your regex to a literal prefix or use [^"]* / \S+ instead of .*.
  • Patterns affect grouping, not just AI prompts. Once a pattern matches, the redacted form is what gets stored in MongoDB and what shows up in the dashboard. The original text is discarded - there is no "show me the raw line" toggle. Test on a sample before adding a pattern to a production site.
  • Patterns do NOT apply to file content. They only run on the log line and traceback at detection. Code that the connector uploads as context goes through a separate sanitizer pipeline (the connector-side sanitizer.py / .js / .php / .php for WordPress).
  • No retroactive sanitisation. Adding a pattern today does not redact errors that were detected yesterday - those rows stay as they were.

Removing a pattern

Delete the line from the textarea and click Save. To clear every extra pattern at once, empty the textarea and save. Patterns can also be edited freely - there is no version history on the list itself; the audit trail records every save with who made the change and when.