fix: use [[]] delimiters for placeholders to prevent HTML encoding issues (#38)
authorStefan Gasser <redacted>
Fri, 16 Jan 2026 15:40:04 +0000 (16:40 +0100)
committerGitHub <redacted>
Fri, 16 Jan 2026 15:40:04 +0000 (16:40 +0100)
commitd239944614c8be1153cdb8ccfc2afb2b48a94f30
treed13ac79d88104113133dd9b1f80110b8b0daad80
parentb2116e82aa1d1d3a9ea099dda7bff885e9d3c5d6
fix: use [[]] delimiters for placeholders to prevent HTML encoding issues (#38)

Fixes #36 - HTML-encoded placeholders now unmask correctly

Changes:
- Changed placeholder format from <TYPE_N> to [[TYPE_N]]
- Created src/constants/placeholders.ts as single source of truth
- Removed configurable redact_placeholder (was bug - streaming hardcoded [[)
- Updated dashboard regex for yellow highlighting
- Added tests for HTML/JSON/URL contexts

The [[]] delimiters are safe in HTML, JSON, and URLs - they don't get
entity-encoded like <> did.
19 files changed:
README.md
config.example.yaml
docs/api-reference/dashboard-api.mdx
docs/concepts/mask-mode.mdx
docs/configuration/logging.mdx
docs/configuration/secrets-detection.mdx
docs/introduction.mdx
src/config.ts
src/constants/placeholders.test.ts [new file with mode: 0644]
src/constants/placeholders.ts [new file with mode: 0644]
src/routes/proxy.ts
src/secrets/detect.test.ts
src/secrets/multimodal.test.ts
src/secrets/redact.test.ts
src/secrets/redact.ts
src/services/masking.test.ts
src/services/masking.ts
src/services/stream-transformer.test.ts
src/views/dashboard/page.tsx
git clone https://git.99rst.org/PROJECT