ruby 34 lines · 7 steps

Redacting secrets in Ruby object output

A credentials class that scrubs sensitive fields from every serialization path so secrets never leak into logs or JSON.

Explained by highlit

Intermediate serialization introspection security metaprogramming logging

1class Credentials
SENSITIVE = %i[password api_key secret_token access_key].freeze
REDACTED = "[REDACTED]".freeze
4 
attr_reader :username, :password, :api_key, :secret_token, :access_key
6 
def initialize(username:, password:, api_key:, secret_token:, access_key:)
  @username = username
  @password = password
  @api_key = api_key
  @secret_token = secret_token
  @access_key = access_key
end
14 
def to_h
  instance_variables.each_with_object({}) do |ivar, memo|
    name = ivar.to_s.delete_prefix("@").to_sym
    memo[name] = SENSITIVE.include?(name) ? REDACTED : instance_variable_get(ivar)
  end
end
21 
def inspect
  fields = to_h.map { |name, value| "#{name}=#{value.inspect}" }.join(", ")
  "#<#{self.class.name} #{fields}>"
end
26 
def to_s
  inspect
end
30 
def as_json(*)
  to_h
end
34end

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Centralize redaction in one method so every output path stays consistent by definition.
2Overriding inspect and to_s prevents secrets from leaking into logs and error traces.
3A frozen list of sensitive keys makes the redaction policy explicit and easy to audit.

Related explainers

ruby

require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection

Intermediate 7 steps

ruby

class UserAgentParser
  BROWSERS = [
    [/Edg\/([\d.]+)/, "Edge"],
    [/OPR\/([\d.]+)/, "Opera"],

Parsing user-agent strings in Ruby

regex pattern-matching lookup-tables

Intermediate 8 steps

rust

use axum::{
    extract::{Path, State},
    response::sse::{Event, KeepAlive, Sse},
};

Streaming import progress with SSE in Axum

server-sent-events streams watch-channel

Advanced 7 steps

ruby

class LogAggregator
  BUCKET_FORMAT = "%Y-%m-%dT%H:%M"
 
  def initialize(entries)

Bucketing log entries by the minute in Ruby

aggregation hashing enumerable

Intermediate 5 steps

ruby

class WeeklySignupsReport
  DEFAULT_WEEKS = 12
 
  def initialize(weeks: DEFAULT_WEEKS, source: User.all)

Building a weekly signups report in Rails

service object aggregation group by

Intermediate 7 steps

ruby

class ApplicationController < ActionController::Base
  EXPERIMENTS = {
    checkout_button_color: %w[control blue green],
    onboarding_flow: %w[control streamlined]