Stream an exported access log, redact the query parameters, headers, addresses and identifiers a policy declares, and write the redacted records somewhere else. Every record this tool cannot vouch for is quarantined: withheld from the output, located by line number and shape, and never echoed into a message.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/access-log-pii-redactor.mjs --root examples/cleanRead the result
stdout carries the JSON report and nothing else, so it pipes straight into a parser. stderr carries the human summary and diagnostics -- a populated stderr is correct, not a warning sign.
Scope
This tool cannot tell you a log is free of personal data. It removes what the policy names and what the enabled detectors match. A pass means those rules were applied to every record and every record was written; it is not a statement about what is left.