Hide what matters before you paste.

Install

One binary for Linux, macOS and Windows (amd64 and arm64), with no runtime to install. Or download it from GitHub Releases.

brew install phoenix1331/tap/cuddio

scoop bucket add phoenix1331 https://github.com/phoenix1331/scoop-bucket
scoop install cuddio

go install github.com/phoenix1331/cuddio@latest

Homebrew, Scoop and the release download need nothing else installed. go install needs Go 1.26 or later, and puts cuddio in Go's bin folder ($(go env GOPATH)/bin), which needs to be on your PATH; the README has step-by-step instructions.

Quick start

$ cat storage/logs/laravel.log | cuddio      # clean stdin to stdout
$ cuddio app.log -o app.clean.log           # write to a new file, never the input
$ cuddio --clip                             # clean the clipboard in place

Try it on the fake files in examples/, which have a command for each.

Why Cuddio

Developers paste logs, stack traces, config and database dumps into AI chats every day, and those often hold API keys and passwords as well as customers' emails, phone numbers and names. Sending personal data to a third-party AI service can breach UK GDPR and company policy, even when nobody meant any harm. Cuddio cleans the text first, on your machine.

Alongside other tools

Cuddio is not the only tool in this space, and it may not be the right one for you.

What it does

SQL dumps

MySQL and MariaDB, PostgreSQL (including COPY blocks) and SQLite dumps, streamed in bounded memory. Every value in a sensitive column is hidden whole, pattern rules still run on every string, and the output stays valid SQL. The dialect is detected from the dump's header.

$ cuddio dump.sql -o dump.clean.sql
$ cuddio dump.sql --mode fake  # realistic fakes
$ cuddio dump.sql --dialect postgres

Put the real values back

Clean with --map to keep the placeholder mapping for the session: an owner-only file in your cache directory that expires after an hour. Paste the AI's reply into cuddio restore and the real values come back. Placeholders Cuddio never handed out are left alone.

$ cuddio app.log --map
$ cuddio restore < ai-answer.md
$ cuddio forget  # delete it now

Clean the clipboard

Copy, clean, paste. cuddio --clip works on Windows, WSL, macOS and Linux (wl-clipboard, xclip or xsel), and restore --clip puts the values back, kept out of Windows clipboard history.

$ cuddio --clip
$ cuddio restore --clip

Checks in CI

--check exits 1 when anything would be hidden; --report counts by rule. Neither ever prints a value, so they are safe in public build logs. Exit code 2 means an error, so a pipeline can tell "would redact" from "broke".

$ cuddio --check fixtures/support-log.txt
$ cuddio --report fixtures/support-log.txt
$ cuddio rules --category pii

Your own rules

A .cuddio.yaml in your project adds custom rules, allowlist entries and sensitive columns, and switches rules on or off. A global file in your config directory applies everywhere; the project file wins.

Configuration

Cuddio reads cuddio/config.yaml in your config directory (~/.config, ~/Library/Application Support or %AppData%), then the nearest .cuddio.yaml, walking up to the repository root. --config FILE uses a file of your choice instead of the project one. Unknown settings are errors, and errors never repeat values from the file.

# .cuddio.yaml
mode: placeholder
rules:
  enable: [uk-postcode]
  disable: [high-entropy-assignment]
  custom:
    - id: internal-host
      category: secret
      label: HOST
      pattern: '[a-z]+\.internal\.example\.com'
allowlist:
  values: [hello@example.com]
  patterns: ['^test-']
sql:
  columns: [notes]
  tables:
    orders: [delivery_instructions]
mapping:
  ttl: 30m

What Cuddio detects

242 rules: 29 of Cuddio's own, and 213 derived from gitleaks. cuddio rules lists them all with their state under your config.

Personal data (PII)

Sensitive SQL columns

In SQL dumps, every value in these columns is hidden, whatever it looks like. Each also matches with a prefix (billing_email, customer_first_name), except name, which matches only exactly so product_name is left alone.

Secrets

Security and your data