tracescrub

trace.zip records every action with its parameters, so fill(password) stores the password in plain text. These files are uploaded as CI artifacts, shared in bug reports and read by AI agents. Anyone who can download the artifact gets the test account's credentials.

• Finds secrets in traces, HTML reports, HAR files and storageState JSON, and reports them with a masked preview.
• Rewrites the files with [REDACTED:<rule>] in place of each secret and keeps zips valid, so the trace still opens in the trace viewer.
• Detects known values from --env and --env-file, built-in patterns, Playwright password fills and storageState entries.
• A secret found by structure is remembered and redacted everywhere else it appears.

Node 20 or newer.

Where does it run in CI?

After your tests and before actions/upload-artifact. The GitHub Action can scrub in place, or use mode: check to fail the job when anything is found.

What are the exit codes?

check exits 0 if clean, 1 if anything is found or some content could not be scanned, and 2 on usage errors. Pass --allow-unscanned to accept unscanned content.

Does it redact screenshots?

Not yet. Screenshots and screencast frames in traces and reports are copied unchanged.

Is it a guarantee?

No. It is defence in depth. Patterns have false positives and false negatives, so use dedicated test accounts with short-lived credentials and keep artifact retention short.

Is it production-ready?

The README marks it as an MVP / prototype.