The issue called for package defaults that maximize security for IP-related handling, while still allowing trusted processing servers to skip encryption for performance. This change makes encrypted regex handling the default and introduces an explicit opt-out path for trusted environments.

• Behavior change: secure default for IP regex loading

  • ExtractionHeuristicPreValidator now resolves Drogon IP regex via a helper that:
    • defaults to encrypted/decrypted regex (S3_LOG_EXTRACTION_ENCRYPT_IP_REGEX default: enabled),
    • supports explicit plaintext override only when encryption is disabled.

• Trusted-server override path

  • Added plaintext-mode contract:
    • S3_LOG_EXTRACTION_ENCRYPT_IP_REGEX=false
    • S3_LOG_EXTRACTION_DROGON_IP_REGEX=<plaintext regex>
  • If plaintext mode is enabled without a provided regex, initialization raises a clear EnvironmentError.

• Focused coverage + docs alignment

  • Added targeted tests for:
    • default encrypted mode,
    • plaintext override mode,
    • required env var enforcement in plaintext mode.
  • Updated README environment-variable docs to reflect default-secure behavior and trusted-server opt-out configuration.

# default (secure): encrypted regex path
export S3_LOG_EXTRACTION_PASSWORD="your_encryption_password"

# trusted server opt-out
export S3_LOG_EXTRACTION_ENCRYPT_IP_REGEX="false"
export S3_LOG_EXTRACTION_DROGON_IP_REGEX="<plaintext regex>"