Sanitize, format, and process istio envoy config payloads 100% in-browser with zero cloud upload risk.
Process and sanitize Envoyconfigshield payloads 100% privately inside browser memory
Drop Local File Here or Click to Browse
Supports CSV, JSON, TXT, XML & Log Streams
istioctl proxy-config all pod-name -o json | jq 'walk(if type == "object" and has("inline_bytes") then .inline_bytes = "[REDACTED_SDS_B64]" elif type == "object" and has("inline_string") then .inline_string = "[REDACTED_SECRET]" else . end)'⚠️ Why Naive CLI / Regex Fails: Standard jq walk() scripts miss protobuf Any-typed @type configs (envoy.extensions.transport_sockets.tls.v3.Secret), fail on older jq builds without walk/1, and leave JWT local_jwks, Lua filter bearer tokens, and xDS gRPC call_credentials exposed in raw cluster dumps.
🛡️ Pre-LLM & Ticket Safety: How to sanitize an Istio istioctl proxy-config / Envoy /config_dump JSON file before pasting into ChatGPT, Claude, or Cursor or sending to Tetrate / Solo.io support
Core capabilities built into EnvoyConfigShield
Automatically detects envoy.admin.v3.SecretsConfigDump dynamic_active_secrets and masks tls_certificate private_key inline_bytes without corrupting protobuf JSON descriptors.
Sanitizes envoy.extensions.filters.http.oauth2 hmac_secret, token_secret, and ext_authz gRPC initial_metadata authorization headers across all HTTP connection managers.
Consistently hashes internal *.svc.cluster.local endpoints, upstream socket_address IPs, and TLS server_names so route matching logic remains verifiable.
Eliminate GitHub GH013 secret scanning rejections on Envoy test fixtures and safely debug xDS routing failures in Claude, ChatGPT, or vendor tickets.
Zero configuration, zero cloud server dependencies, instant execution.
Drop raw Envoy admin :15000/config_dump exports or istioctl proxy-config secret/bootstrap JSON dumps directly into local browser RAM.
AST-aware Envoy v3 parsers mask SecretsConfigDump inline_bytes, generic_secret inline_string tokens, JWT jwks, and gRPC metadata headers while preserving listener and route graphs.
Inspect 70% of the sanitized Envoy config_dump immediately or unlock 100% export and the air-gapped Offline PRO HTML workstation for $19 one-time.
See why merchants and prosumers switch from monthly subscriptions to our local buyout.
| Feature / Metric | 🛡️ EnvoyConfigShield | ☁️ Cloud SaaS (Tetrate) |
|---|---|---|
| Data Processing Architecture | 🛡️ 100% Local Browser RAM (Zero Network Egress) | ☁️ Cloud SaaS Upload |
| Envoy v3 Any (@type) & SDS Secret Handling | 🛡️ Schema-Aware SecretsConfigDump & HTTP Filter AST Parser | ☁️ Cloud SaaS Upload |
| Cluster Topology & SNI Correlation | 🛡️ Deterministic Hash Mapping Across Listeners, Routes & Clusters | ☁️ Cloud SaaS Upload |
| Pre-LLM & Git GH013 Compliance Readiness | 🛡️ Instant Gitleaks & GH013 Clean Envoy Dump Output | ☁️ Cloud SaaS Upload |
Eliminate vendor lock-in and cloud upload security risks.
Why pay monthly recurring SaaS fees for simple istio envoy tools? Switch to EnvoyConfigShield for a single $19 buyout.
Tetrate uploads private data to cloud servers. We process 100% locally on your machine.
Process large istio envoy files instantly without waiting for cloud server roundtrips.
Deep technical breakdown driving our client-side productivity engine.
Processes EnvoyConfigShield structures directly inside isolated browser memory.
Ensures zero EnvoyConfigShield bytes touch external API servers or third-party storage.
Parses high-throughput EnvoyConfigShield records in real-time with sub-millisecond response times.
Full compliance with international privacy mandates through total data sovereignty.
No monthly bills. No sneaky price hikes. Pay once, use forever.
Live Local Studio Preview
Prosumer & Solo Professional
One-Off Emergency Unlock & Trial
Everything you need to know about privacy, local memory execution, and buyouts.
An Envoy config_dump (especially when captured with ?include_eds or from admin port 15000) embeds active SDS mTLS private keys in inline_bytes, OAuth2 filter HMAC secrets, JWT local_jwks, and gRPC call_credentials access tokens.
Envoy v3 nests secrets inside polymorphic protobuf Any objects (@type: type.googleapis.com/envoy.extensions...) as well as Lua filter source code and gRPC metadata headers. Simple jq key deletions miss custom filter credentials or break route references.
Secret scanners trigger on Base64 PEM private keys inside SecretsConfigDump and Bearer tokens inside bootstrap access_log or tracing headers. EnvoyConfigShield replaces every sensitive node with schema-valid redacted tokens.
Yes. Listener filter chains, VirtualHost domains, cluster weights, and EDS locality structures remain 100% intact while cryptographic keys and tokens are scrubbed.
Never. All JSON AST traversal, SDS certificate masking, and Canvas telemetry visualization execute 100% locally in your browser RAM with zero network calls.