Masking a JVM thread dump without breaking the analysis

说明与用途

tm-anon CLI 工具通过将用户标识符替换为令牌来掩码 JVM 线程转储，保留分析所需的结构，从而在不影响分析准确性的前提下安全上传到第三方服务。

问题

Uploading production JVM thread dumps to third‑party analyzers violates policy, but the dumps contain sensitive identifiers that must be preserved for accurate analysis.

结果

Masked dumps produce identical analysis results (same problems, severities, health score) as original dumps, while preventing accidental leakage of sensitive identifiers.

工作流

• Create a vault with tm-anon init – generates a key and reverse map file.
• Run tm-anon mask <dump> – rewrites the dump, tokenizing user identifiers, stripping or redacting non‑essential lines, and verifies no sensitive data remains.
• Upload the resulting .anon.txt to the analyzer (e.g., ThreadMine).
• Download the analysis report and run tm-anon unmask <report> to restore original names locally for interpretation.

证据

The rule "the contents of angle brackets are an address, keep them verbatim" was correct for every dump I'd looked at and was quietly handing over a class name on the newest JDK.

来源

Same set of detected problems, same severities, same health score on every one.

来源