# redaction — JFR In-Process Data Redaction (JEP 536)

Companion module for the ankurm.com post
**"JFR In-Process Data Redaction (JEP 536): Safe Flight Recordings in Production"**
(https://ankurm.com/jfr-data-redaction-jep-536-safe-flight-recordings-in-production/).
It extends the JFR / Mission Control post's workflow with the JDK 27 feature that
removes secrets from recordings before they are written.

No Maven and no dependencies: two small Java files and shell scripts.

| Component | Version | Verified against |
|---|---|---|
| JDK (redaction runs) | Temurin 27.0.1.0.2+1 | `java -version`; JEP 536 status "Closed / Delivered", release 27 |
| JDK (leak baseline) | Temurin 25.0.5+8 | `java -version`; JDK 25 has no redaction |

## Layout

| Path | What it is |
|---|---|
| `src/Workload.java` | Trivial program; the secrets are on its command line, `-D` flags and environment |
| `src/Scan.java` | Checks a `.jfr` file for planted secrets, by raw bytes and by decoded events |
| `filters/keys.txt`, `filters/args.txt` | Filter files for `redact-key=@...` / `redact-argument=@...` |
| `scripts/common.sh` | Plants seven fake secrets under `env -i` (your real environment is never passed in) |
| `scripts/run-all.sh` | Regenerates every file in `output/` |
| `output/*.txt` | Captured real output, quoted verbatim in the post |

## Run it

```bash
JDK27=/path/to/jdk-27 JDK25=/path/to/jdk-25 redaction/scripts/run-all.sh
```

## Output index

| File | What it shows |
|---|---|
| `01-jdk25-leak.txt` | JDK 25: all seven secrets sit in the recording |
| `02-jdk27-defaults.txt` | JDK 27, no flags: three secrets redacted, four still leak |
| `03-jdk27-opt-out.txt` | `redact-argument=none,redact-key=none` brings every leak back |
| `04-jdk27-custom-inline.txt` | `conn*` fails to match `DB_CONN` (globs are anchored); `*conn*` fixes it |
| `05-jdk27-filter-files-and-debug-log.txt` | Filter files with `@`, and `-Xlog:jfr+redact=debug` |
| `06-jdk27-missing-filter-file.txt` | A missing filter file stops the JVM at startup |
| `07-jdk27-no-plus-replaces-defaults.txt` | Without `+`, your list replaces the defaults |
| `08-jdk27-jcmd-late-recording.txt` | A recording started later with `jcmd JFR.start` is redacted the same way |