Introducing Shroud: Sensitive Data Detection and Masking for Markdown
An open-source CLI tool and .NET library for privacy-first document workflows
I have been building tools for working with sensitive data in markdown files - trading journals, research notes, deployment logs, AI conversation exports. The kind of documents where crypto addresses, API keys, and financial figures end up alongside the analysis you actually want to share or store safely.
The result is Shroud - an open-source CLI tool and .NET library that detects sensitive data in markdown, replaces it with deterministic tokens, and stores the originals in an encrypted vault. Built in C# / .NET 8 with zero external dependencies.
The Problem with Sensitive Data in Documents
Where sensitive data hides in plain text:
- Trading journals with wallet addresses and transaction hashes
- Deployment logs with API keys and connection strings
- Research notes with financial figures and account identifiers
- AI conversation exports containing credentials or personal data
Existing solutions sit at two extremes. Enterprise DLP suites are heavyweight, designed for corporate compliance workflows, and assume you want to block data from leaving a perimeter. Simple regex find-and-replace scripts catch obvious patterns but lose the ability to correlate values across files - if the same wallet address appears in five documents, you want to know that.
Nothing targets markdown specifically, understands context (is "sol" a Solana reference or part of "solution"?), or provides a clean separation between who can mask data and who can reveal it.
How Shroud Works
Four operations, each building on the last:
Detect sensitive spans using 70+ patterns with confidence scoring. Each detection includes a confidence level based on structural markers and surrounding context.
Replace detected spans with deterministic tokens. The same value always produces the same token, so you can track correlations across files without seeing the original data.
Encrypt the original values with AES-256-GCM and store them in a vault file. The masked copies go in a public directory. A manifest tracks token metadata without exposing values.
Decrypt the vault and restore original values. This is the only operation that requires a password - and the only one that decreases safety.
Three-Tier Trust Architecture
Most access control systems think in terms of read and write permissions. Shroud thinks in terms of safety direction - masking increases safety (one-way tokenization), revealing decreases it (requires password). Permission boundaries follow this risk direction.
Read masked files, correlate tokens across documents, run diagnostics. Zero trust required. Agents and automated tools operate at this tier - they can reason about token patterns without ever seeing original values.
Mask files, batch processing, CI pipeline integration. Requires a key file for deterministic token generation. Can create masked output but cannot reverse it.
Reveal original values, manage encryption keys. Requires a password. Only the human who owns the data should operate at this level.
What It Detects
70+ detection patterns across five domains, each with context-aware confidence scoring:
On-Chain
Crypto addresses (EVM, Bitcoin, Solana, Cardano, and 11+ more chains), transaction hashes, ENS names, explorer URLs
Credentials
API keys for 30+ services (GitHub, Anthropic, AWS, Stripe, and more), access tokens, webhook secrets
Secrets
PEM private keys, JWTs, database connection strings, password assignments
Financial
Currency amounts, market pairs (EUR/USD), Luhn-validated credit cards, quantities
Identity
SSNs, IBANs, IP addresses, MAC addresses, email addresses, phone numbers
What's Next
Shroud is both a CLI tool and a library. The CLI handles the common workflow - scan, mask, vault, reveal. But the library API is designed for integration into larger systems. The detection engine, tokenizer, and vault are all independently composable.
I am already building on top of the library for something new. Stay tuned.
Shroud is open source under the Apache-2.0 license. Contributions, bug reports, and feature requests are welcome.
View on GitHub →