56 — Redacted secrets

Redacted.make wraps sensitive values so ordinary string conversion and inspection do not reveal them. Call Redacted.value only at the narrow integration point that must use the secret. V4 exposes Redacted.wipeUnsafe for exceptional cases that require best-effort erasure.

Use Config.redacted when loading secrets and avoid putting the unwrapped value into logs, errors, spans, metrics, or long-lived application state.

The full test suite

The index.test.ts for this lesson, verbatim from steps/56-redacted/.

1
import { describe, expect, it } from "vite-plus/test"
2
import { Redacted } from "effect"
3

4
describe("Redacted", () => {
5
  it("does not reveal secrets through string conversion", () => {
6
    const secret = Redacted.make("super-secret")
7
    expect(String(secret)).not.toContain("super-secret")
8
    expect(Redacted.value(secret)).toBe("super-secret")
9
  })
10

11
  it("supports explicit equivalence without exposing values", () => {
12
    const equivalent = Redacted.makeEquivalence<string>((a, b) => a === b)
13
    expect(equivalent(Redacted.make("same"), Redacted.make("same"))).toBe(true)
14
  })
15
})

10·01Redacted

56 — Redacted secrets

The full test suite