RedactShot

AI identifies sensitive information. Deterministic server-side code permanently overwrites the pixels, flattens the image, and removes metadata.

RedactShot proposes sensitive regions based on the sharing destination, shows a numbered preview, and requires a separate reviewed apply action. It never asks an image model to fabricate a “redacted” result. The final PNG is rendered server-side by overwriting pixels with solid masks, flattening alpha data, applying safe orientation, and stripping metadata.

Destination-aware checks

Choose public social media, customer support, coworker, bug report, AI assistant, or general external sharing. The preview can identify names, email addresses, phones, addresses, account/payment data, authentication tokens, API keys, customer details, browser tabs, notifications, profile photos, internal URLs, organization names, and other contextual risks.

Reusable privacy profiles

Choose a profile for the work you repeat most often:

• destination_default keeps the destination-aware baseline.
• strict_external gives extra attention to anything unsafe outside the organization.
• credentials_and_financial emphasizes tokens, keys, account data, and payment details.
• customer_data emphasizes customer identifiers and support context.
• screen_share emphasizes browser chrome, notifications, profiles, and internal URLs.

A profile adds focus. It never suppresses the destination-aware baseline.

Mandatory two-run workflow

1. Run action: preview and inspect every numbered region.
2. Copy input_sha256 into expected_input_sha256.
3. Copy the signed preview_token into the apply run.
4. Copy regions into confirmed_regions.
5. If anything is wrong or missing, create a new preview with clearer guidance.
6. Otherwise run action: apply with the exact returned regions and confirmation: APPLY REDACTIONS within one hour.

Apply never runs detection again. It verifies that the normalized image still matches the reviewed SHA-256 digest and that confirmed_regions exactly match the plan bound into the signed preview token, then masks that reviewed plan. Automatic detection can miss context-sensitive data, so do not share the result without a final human inspection.

Every preview and apply result includes an audit_report. The preview report records the input hash, signed-plan hash, selected profile, and proposed region types without claiming that redaction happened. The apply report adds the output hash and confirms the deterministic pixel overwrite, RGB flattening, and metadata removal.

Bounded batch workflow

The repository includes scripts/redactshot_batch.py for API users. It runs one separately billed Actor run per image, stops on the first failed or ambiguous run, and never retries a start request whose response was lost. Preview and apply remain separate batches so every plan can be reviewed.

python scripts/redactshot_batch.py preview \
  --manifest preview-items.json \
  --output preview-results.json \
  --max-paid-runs 5 \
  --max-total-charge-usd-per-run 1.25

Both cost-control flags are mandatory. --max-paid-runs caps the number of images. --max-total-charge-usd-per-run is sent to Apify for each run. Choose that ceiling only after checking Apify's current displayed total. An apply manifest must carry each reviewed preview's exact image, destination, privacy profile, input hash, signed token, regions, and APPLY REDACTIONS confirmation.

No separate Dravara account, API key, integration, or support handoff is required. Each preview and apply is an ordinary Actor run whose dataset and PNG remain in that run's storage. A failed run does not continue in the background. For validation failures, correct the named field and start the applicable step again. For a temporary service failure, wait a few minutes and start one new run. If a charge, dataset, or artifact state ever looks unclear, do not loop automatic retries: inspect that run's Charges, default dataset, and key-value store first. Never apply an unreviewed preview merely to recover from an error. The Self-service failure details output opens the sanitized key-value-store OUTPUT record with the stable error code, retry guidance, and next action.

Billing

Dravara's creator charge for a successful preview is $0.60005: the $0.00005 apify-actor-start event plus $0.60 for redaction-preview-created. The creator charge for a successful apply is $0.10005: the start event plus $0.10 for redacted-image-created. The complete successful two-run workflow has a $0.70010 Dravara creator charge. Apify separately passes its variable platform usage for each run to the customer and determines the final displayed total; Dravara does not reduce its creator charge to absorb that usage. Result events are captured only after their artifacts exist. Failed validation or provider steps skip the result event, but the Actor-start charge and Apify platform usage can still apply. The synthetic preview input is billed like any other run.

Privacy and limits

PNG, JPEG, and WebP; one image per run; up to 12 MB, 8,192 pixels per side, and 20 megapixels. Screenshots selected with the Apify Console file uploader are read inside this limited Actor with its scoped storage access. Direct inline data URLs should stay at or below 6 MB of raw image bytes because Apify run-input requests have a smaller limit than uploaded or remote files. Preview content is processed by Dravara, LLC's private service and the OpenAI API using store: false; applicable provider abuse-monitoring retention may still apply. Apply is deterministic server-side code and does not call the image model again. Apify retains run input/output under the runner's settings.

Do not use RedactShot as the sole control for regulated or legally mandated redaction. Optional defect contact: support@dravarahq.com. Send only the Apify run ID and safe error text, never the input. Support does not complete or deliver failed runs.