DEV Community

Xvibelabs
Xvibelabs

Posted on Originally published at xvibelabs.com

How to Redact Internal Directives, Bearer JWTs, and PII Variables from GraphQL Schemas & Query Logs in Local Browser RAM

#webdev #privacy #opensource #programming

title: How to Redact Internal Directives, Bearer JWTs, and PII Variables from GraphQL Schemas & Query Logs in Local Browser RAM
published: true
tags: graphql, security, webdev, infosec

canonical_url: https://xvibelabs.com/tools/073-graphql-schema-inspector/

When debugging complex GraphQL APIs—whether across federated subgraphs, Hasura permissions, or Apollo client traces—engineers regularly export .graphql Schema Definition Language (SDL) files, __schema introspection JSON payloads, and operation variables dumps.

However, attaching raw GraphQL artifacts to vendor support tickets, GitHub issues, or external QA threads introduces four critical leak vectors:

  1. Internal RBAC & Federation Directives: Custom directives like @auth(role: ADMIN), @internal(upstream: "http://10.24.8.19:8080"), or federation @link URLs expose your internal microservice topology.
  2. Admin Headers & Session JWTs: Exported GraphQL trace logs often retain Authorization: Bearer <JWT>, x-hasura-admin-secret, or session cookies.
  3. Plaintext PII in Operation Variables: A failed CreatePaymentIntent or UpdateCustomerProfile mutation dump almost always carries real customer emails, billing addresses, card tokens, or SSNs inside the variables JSON object.
  4. Cloud Formatter Egress Risk: Pasting proprietary schemas or production query logs into server-side online formatters transmits your API blueprint to an unknown third party.

Structure-Preserving In-Browser GraphQL Sanitization

To solve this without requiring a $49/seat/month cloud workspace, we built GraphQL Schema & Query Token Redactor (073-graphql-schema-inspector), which executes 100% inside local browser RAM.

// Deterministic 3-Tier GraphQL Variable & Directive Scrubbing
const sanitizeGraphqlPayload = (rawPayload, intensityPct = 70) => {
  return rawPayload
    .replace(/(Bearer\s+)[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/gi, '$1[REDACTED_GQL_JWT]')
    .replace(/((?:x-hasura-admin-secret|x-api-key|cardToken)"\s*:\s*")([^"]+)(")/gi, '$1[REDACTED_GQL_SECRET]$3')
    .replace(/@(?:internal|auth|private)\([^)]*\)/gi, '@directive([REDACTED_META])');
};
Enter fullscreen mode Exit fullscreen mode

Key Capabilities

  • 3-Tier Redaction Depth Slider (35% / 70% / 95%): Switch seamlessly between partial prefix masking for internal debugging (35%), standard token & PII scrubbing (70%), and strict Safe-Harbor directive & endpoint stripping (95%).
  • Instant Free 70% Plaintext Export: Copy or download the first 70% of sanitized GraphQL records immediately for free—no login wall.
  • Air-Gapped PRO Workstation: Need unlimited multi-file batch sanitization for large __schema introspection dumps? Unlock the standalone offline HTML5 workstation (€3.99 24h Pass or $19 lifetime buyout).

Try the interactive sandbox right in your browser: https://xvibelabs.com/tools/073-graphql-schema-inspector/

👉 Open GraphQL Schema & Query Token Redactor Live Sandbox

🔗 Related Local-First Utilities in the XVibe Suite

If your team handles sensitive diagnostic payloads across multiple layers of the stack, explore our companion zero-cloud browser tools:

Top comments (0)