jfr/redaction

redaction — JFR In-Process Data Redaction (JEP 536)

Companion module for the ankurm.com post "JFR In-Process Data Redaction (JEP 536): Safe Flight Recordings in Production" (https://ankurm.com/jfr-data-redaction-jep-536-safe-flight-recordings-in-production/). It extends the JFR / Mission Control post's workflow with the JDK 27 feature that removes secrets from recordings before they are written.

No Maven and no dependencies: two small Java files and shell scripts.

Component	Version	Verified against
JDK (redaction runs)	Temurin 27.0.1.0.2+1	java -version; JEP 536 status "Closed / Delivered", release 27
JDK (leak baseline)	Temurin 25.0.5+8	java -version; JDK 25 has no redaction

Layout

Path	What it is
src/Workload.java	Trivial program; the secrets are on its command line, -D flags and environment
src/Scan.java	Checks a .jfr file for planted secrets, by raw bytes and by decoded events
filters/keys.txt, filters/args.txt	Filter files for redact-key=@... / redact-argument=@...
scripts/common.sh	Plants seven fake secrets under env -i (your real environment is never passed in)
scripts/run-all.sh	Regenerates every file in output/
output/*.txt	Captured real output, quoted verbatim in the post

Run it

JDK27=/path/to/jdk-27 JDK25=/path/to/jdk-25 redaction/scripts/run-all.sh

Output index

File	What it shows
01-jdk25-leak.txt	JDK 25: all seven secrets sit in the recording
02-jdk27-defaults.txt	JDK 27, no flags: three secrets redacted, four still leak
03-jdk27-opt-out.txt	redact-argument=none,redact-key=none brings every leak back
04-jdk27-custom-inline.txt	conn* fails to match DB_CONN (globs are anchored); *conn* fixes it
05-jdk27-filter-files-and-debug-log.txt	Filter files with @, and -Xlog:jfr+redact=debug
06-jdk27-missing-filter-file.txt	A missing filter file stops the JVM at startup
07-jdk27-no-plus-replaces-defaults.txt	Without +, your list replaces the defaults
08-jdk27-jcmd-late-recording.txt	A recording started later with jcmd JFR.start is redacted the same way