From 1f8b74e174343d69d133bee699bacbedb889f5a7 Mon Sep 17 00:00:00 2001 From: Johan Ruokangas Date: Tue, 16 Apr 2024 13:07:56 +0300 Subject: [PATCH] feat: improved documentation --- README.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c0c8ecb..b3903f5 100644 --- a/README.md +++ b/README.md @@ -5,9 +5,9 @@ ![GitHub License](https://img.shields.io/github/license/jozan/secret?style=flat) ![Static Badge](https://img.shields.io/badge/made%20with%20-%20husqvarna%20vacuum%20cleaner%20-%20made%20with%20husqvarna?style=flat&logo=husqvarna) -`secret` is a simple utility libraty for managing secrets in a TypeScript app. +`secret` is a simple utility library for managing secrets in a TypeScript app. -the main purpose is to prevent accidenal leaking of secrets into logs, +the main purpose is to prevent accidental leaking of secrets into logs, stdout, JSON.stringify calls, writes to files and so on by the developer. the secret is still stored in memory unencrypted and can be read by a debugger @@ -41,6 +41,19 @@ console.log(hidden); // logs [REDACTED] const exposed = Secret.expose(hidden); ``` +## aknowledgements + +the idea for this library came from the rust cargo [`secrecy`](https://docs.rs/secrecy/latest/secrecy/). + +the implementation is based on the following libraries: + +- [`secret-value`](https://github.com/transcend-io/secret-value) +- [`effect/secret`](https://github.com/Effect-TS/effect/blob/main/packages/effect/src/internal/secret.ts) + +this improves on the above libraries by hiding the raw value of the secret +(bytes array) from leaking when calling `console.log` or `utils.inspect` on the +secret object. additionally the raw value is not retrievable by object access. + ## development To install dev dependencies: