Module diagnostics 

Credential redaction and crash capture for diagnostic logs.

TRACES: UR-078 | DR-218

Why redaction lives here and not at the export

A diagnostic bundle is something a user attaches to a public bug report. If a Jellyfin access token can reach it, this feature is a credential-disclosure bug with a friendly button on it.

So redact runs in the log formatter — the token never reaches disk — and again over every line the exporter copies, which covers files written by an older build that lacked the formatter pass. Redacting only at export would leave the secret sitting in a file on the device, which is exactly the thing we are trying not to do.

What is deliberately NOT redacted

Server host, item ids, filenames and paths inside the app’s own directories all stay. They are not secrets and they are the entire diagnostic value of a log: a bundle scrubbed of them is one nobody can debug anything from.

Constants

REDACTED

Replacement for a redacted value.

SECRET_HEADERS 🔒

Header names whose value is a credential.

SECRET_JSON_KEYS 🔒

JSON keys whose value is a credential.

SECRET_QUERY_KEYS 🔒

Query-string parameters whose value is a credential.

Functions

install_panic_hook

Install a panic hook that records the panic through log::error! before the default hook runs.

panic_payload_string 🔒

Extract a printable message from a panic payload.

redact

Strip credentials from one log line.

redact_emby_auth 🔒

MediaBrowser Token="abc" -> MediaBrowser Token="[REDACTED]"

redact_headers 🔒

X-Emby-Token: abc -> X-Emby-Token: [REDACTED]

redact_json_values 🔒

"AccessToken":"abc" -> "AccessToken":"[REDACTED]"

redact_query_params 🔒

?api_key=abc&x=1 -> ?api_key=[REDACTED]&x=1

redact_server_url

Reduce a server URL to scheme and host.