Strip customer PII in USER_DEBUG pipes, Named Credential Bearer tokens in CALLOUT_REQUEST, and 18-char Salesforce Record IDs in VARIABLE_ASSIGNMENT 100% in local browser RAM — bypassing sed pipe-delimiter breakage and GH013 blocks.
Process and sanitize Apexlogshield payloads 100% privately inside browser memory
Drop Local File Here or Click to Browse
Supports CSV, JSON, TXT, XML & Log Streams
sed -E 's/(Authorization:[[:space:]]*Bearer[[:space:]]+)[A-Za-z0-9._\-]+/\1[REDACTED_SF_TOKEN]/g; s/(["\x27]?(ssn|taxId|email|phone|access_token)["\x27]?[[:space:]]*[:=][[:space:]]*["\x27]?)[^"\x27|,}\r\n]+/\1[REDACTED_PII]/gi' apex_debug.log⚠️ Why Naive CLI / Regex Fails: Breaks pipe-delimited (|) column indices when serialized SObject blobs in VARIABLE_ASSIGNMENT or USER_DEBUG contain nested JSON/pipes, corrupting VS Code Apex Replay Debugger and leaking 00D/005/003 Salesforce Record IDs.
🛡️ Pre-LLM & Ticket Safety: How to sanitize Salesforce Apex debug logs (USER_DEBUG, SOQL_EXECUTE_BEGIN, CALLOUT_REQUEST) before pasting into ChatGPT, Claude, or Cursor
Core capabilities built into ApexLogShield
Unlike regex tools that strip pipe delimiters inside serialized Contact/Account SObjects, our parser preserves exact timestamp, nanosecond, and line-number columns for Apex Replay Debugger.
Automatically redacts Salesforce 00D session tokens, Bearer headers, and endpoint API keys inside CALLOUT_REQUEST and SYSTEM_METHOD_ENTRY frames.
Replaces sensitive Contact emails, SSNs, IBANs, and 001/003/006 Record IDs with consistent synthetic tokens so SOQL join logic remains traceable.
Eliminates the risk of third-party browser extensions reading live production Salesforce org tabs—processing only the log text dropped into isolated RAM.
Zero configuration, zero cloud server dependencies, instant execution.
See why merchants and prosumers switch from monthly subscriptions to our local buyout.
| Feature / Metric | 🛡️ ApexLogShield | ☁️ Cloud SaaS (Salesforce) |
|---|---|---|
| Data Egress & Execution Architecture | 🛡️ 100% Client-Side Browser RAM (Zero Server Upload) | ☁️ Cloud SaaS Add-on ($49/mo per seat) or broad-permission extension |
| Pipe-Delimited (|) Replay Debugger Framing | 🛡️ AST-Aware Pipe Column & SObject JSON Preservation | ☁️ Regex replacements break pipe column counts on multiline blobs |
| 00D!AQo Session ID & CALLOUT_REQUEST Masking | 🛡️ Automatic OAuth Session, Bearer & API Key Stripping | ☁️ Manual scrubbing before pasting into ChatGPT or Jira tickets |
| 15/18-Character Salesforce Record ID Anonymization | 🛡️ Prefix-Preserving ID Hashing (001/003/005/006/00Q) | ☁️ Strips IDs completely, breaking parent-child SOQL debugging |
Eliminate vendor lock-in and cloud upload security risks.
Why pay monthly recurring SaaS fees for simple salesforce apex tools? Switch to ApexLogShield for a single $19 buyout.
Salesforce uploads private data to cloud servers. We process 100% locally on your machine.
Process large salesforce apex files instantly without waiting for cloud server roundtrips.
Deep technical breakdown driving our client-side productivity engine.
Processes ApexLogShield structures directly inside isolated browser memory.
Ensures zero ApexLogShield bytes touch external API servers or third-party storage.
Parses high-throughput ApexLogShield records in real-time with sub-millisecond response times.
Full compliance with international privacy mandates through total data sovereignty.
No monthly bills. No sneaky price hikes. Pay once, use forever.
Live Local Studio Preview
Prosumer & Solo Professional
One-Off Emergency Unlock & Trial
Everything you need to know about privacy, local memory execution, and buyouts.
Drop your raw .log file from Developer Console or sf apex get log into ApexLogShield. It masks USER_DEBUG customer PII, VARIABLE_ASSIGNMENT SObject fields, and CALLOUT_REQUEST Bearer tokens 100% in local browser RAM.
Apex debug logs rely on strict pipe-delimited (|) column framing (timestamp, event identifier, line number, payload). Naive sed regexes accidentally strip pipes inside serialized SObject JSON, making the log unreadable by Replay Debugger.
Yes. It automatically detects and masks 00D!AQo... session tokens, Named Credential Authorization headers, and API keys that trigger GitHub Secret Scanning (GH013) and Gitleaks.
Browser extensions that format Salesforce logs typically require host permissions on *.force.com and *.salesforce.com, granting read access to live production CRM tabs. ApexLogShield runs in an isolated static sandbox with zero access to your active Salesforce session.
Yes. Standard key prefixes (such as 001 for Account, 003 for Contact, 005 for User, and 006 for Opportunity) are preserved while the tenant-specific suffix is deterministically masked.