PeachSanitize

MSP technicians paste JSON into AI tools every day — API responses, config files, ticket data, automation payloads. Those payloads routinely contain API keys, tokens, email addresses, and internal hostnames that should never leave the client environment. The manual find-and-replace approach is slow, error-prone, and easy to miss. A single overlooked field can expose a client's credentials or PII to a third-party AI service. Most teams have no enforced process at all.

1. 1

   Layer 1 — Key-name heuristic

   Before examining the value, PeachSanitize checks whether the JSON key name contains sensitive words like password, secret, token, key, apikey, auth, or credential (case-insensitive). If matched, the value is replaced regardless of its content — catching the most common MSP scenario where field names already signal sensitivity.

2. 2

   Layer 2 — Regex pattern matching

   If the key is neutral, the value is tested against a library of patterns: JWT/Bearer tokens, email addresses, URLs with embedded credentials, IPv4 addresses, US phone numbers, Social Security Numbers, credit card numbers (Luhn-validated), and FQDNs. The first match wins.

3. 3

   Layer 3 — Shannon entropy detection

   If no pattern matched, the module calculates Shannon entropy on the string. A value scoring above 3.5 with at least 20 characters is flagged as a probable API key or secret — catching raw AWS keys, random UUIDs used as tokens, and custom vendor credentials that do not match known formats.

4. 4

   Plausible replacements

   Detected values are replaced with realistic-looking alternatives (fake emails, same-length keys, 192.168.x.x IPs, (555) 000-xxxx phones) so the sanitized JSON still makes sense to the AI. Replacements are seeded from a new GUID each run — no two runs produce the same output.