The log file betrayed us.
Somewhere inside thousands of lines, plain-text email addresses sat wide open — stored, shipped, archived, and forgotten. Until someone found them.
Masking email addresses in logs is not just about compliance. It is about control. If you let raw email addresses leak into your logs, you invite risk every time those logs are read, backed up, or sent across systems. The fix is simple, and you can enforce it in your local shell, starting with Zsh.
Why Mask Email Addresses in Logs
Logs are often more public than you think. They travel between services, get copied into support tickets, and end up in monitoring dashboards. A single exposed email address can lead to spam, phishing, or worse. Masking removes sensitive parts while keeping enough detail to debug and operate. It stops the data from being dangerous.
Masking Email Addresses with Zsh
In Zsh, you have the power to intercept output before it lands in a file. This means you can use simple pattern substitutions or stream filters to remove sensitive data in real time.
Here’s a minimal example to mask emails before they ever touch disk:
my_command | sed -E 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/[masked-email]/g' >> app.log
This command uses sed to find anything that looks like an email address and replace it with [masked-email]. You can integrate it into your scripts or even wrap your log-writing commands in small functions to guarantee masking happens every time.
For Zsh session-wide protection, you can create a function in your .zshrc:
log_mask() {
"$@"2>&1 | sed -E 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/[masked-email]/g'
}
Then run:
log_mask my_command >> app.log
No unmasked addresses, no accidental exposure.
Beyond the Local Shell
Masking at the shell is powerful, but in many pipelines, logs flow from container to service to cloud storage. If you only filter locally, you still risk leaks upstream. The safest approach is to integrate masking at multiple points: application output, log aggregation, observability platform, and analysis tools.
Automated masking should be part of every logging policy. Search your existing logs for patterns, measure how often sensitive data appears, and set permanent protections.
See It Happen
You can try this end to end in minutes. Spin up a real system, push logs through, and watch the masking happen live. Hoop.dev makes it painless to see masking in action at every point in your stack, no matter the language or platform. In a few clicks, you’ll see your logs clean, safe, and ready for production.