How to Redact PII Span Attributes and Bearer Tokens from OpenTelemetry OTLP JSON Traces in Local RAM

说明与用途

该工具在保留跟踪层次结构的同时，从 OpenTelemetry 跟踪中删除令牌、SQL 字面量、GenAI 提示和内部 IP，支持安全的本地分析。

问题

Exported OpenTelemetry OTLP/JSON trace files often contain production secrets and regulated customer PII in span attributes, exposing sensitive data when shared or formatted in the cloud.

结果

The tool removes bearer tokens, SQL literals, GenAI prompts, and internal IPs from OTLP traces while keeping trace structure intact, allowing secure local analysis and sharing.

工作流

• 1. Load the OTLP/JSON trace file into the OpenTelemetry Trace Redactor browser studio or standalone offline PRO workstation.
• 2. Select a redaction strictness level (35% Partial Trace ID Mask, 70% Standard Span Attribute Mask, or 95% SOC2 & GDPR Safe Harbor Scrub).
• 3. The redaction engine applies a regex pattern to target sensitive attribute values while preserving spanId links.
• 4. Review the sanitized trace in the 12‑column free workbench; copy or download the first 70% of sanitized span records for free.
• 5. For air‑gapped teams, use the standalone offline PRO workstation compiled as a single‑file HTML5 application to scrub traces without internet access.

证据

Pasting an OTLP JSON trace dump into a cloud formatter or attaching it unredacted to a support ticket exposes production authentication tokens and customer PII outside your security boundary.

来源

Instead of corrupting the JSON structure or breaking parent-child spanId links, the local redaction engine targets sensitive attribute values while preserving trace hierarchy.

来源