Wouldn't it be better (or at least easier on the noggin) to use a two-pass approach? (Uses Perl 5.10+  \K regex extension.) 

use 5.010;

use warnings;
use strict;

use Test::More 'no_plan';
use Test::NoWarnings;


use constant SENSITIVE => qr{ password | user }xms;;

VECTOR:
for my $ar_vector (
  [ q/{'password' => 'secret'}/,    q/{'password' => '***'}/, ],
  [ q/{'password' => 'sec\'ret'}/,  q/{'password' => '***'}/, ],
  [ q/{"password" => "secret"}/,    q/{"password" => "***"}/, ],
  [ q/{"password" => "sec\"ret"}/,  q/{"password" => "***"}/, ],
  [ q/{'password' : 'secret'}/,     q/{'password' : '***'}/,  ],
  [ q/{'password' : 'sec\'ret'}/,   q/{'password' : '***'}/,  ],
  [ q/{"password" : "secret"}/,     q/{"password" : "***"}/,  ],
  [ q/{"password" : "sec\"ret"}/,   q/{"password" : "***"}/,  ],

  [ q/{'user' => 'secret'}/,    q/{'user' => '***'}/, ],
  [ q/{'user' => 'sec\'ret'}/,  q/{'user' => '***'}/, ],
  [ q/{"user" => "secret"}/,    q/{"user" => "***"}/, ],
  [ q/{"user" => "sec\"ret"}/,  q/{"user" => "***"}/, ],
  [ q/{'user' : 'secret'}/,     q/{'user' : '***'}/,  ],
  [ q/{'user' : 'sec\'ret'}/,   q/{'user' : '***'}/,  ],
  [ q/{"user" : "secret"}/,     q/{"user" : "***"}/,  ],
  [ q/{"user" : "sec\"ret"}/,   q/{"user" : "***"}/,  ],

  ) {

  my ($string, $expected) = @$ar_vector;

  is elide(SENSITIVE, $string), $expected, "'$string' -> '$expected'";

  }  # end for VECTOR

done_testing;


# subroutines ######################################################

use constant {
    DQ        => qr{ " [^\\"]* (?: \\. [^\\"]*)* " }xms,
    DQ_MASK   => q{"***"},
    SQ        => qr{ ' [^\\']* (?: \\. [^\\']*)* ' }xms,
    SQ_MASK   => q{'***'},
    CONNECTOR => qr{ => | : }xms,
    };

sub elide {

    my ($key,
        $string,
        ) = @_;

    $string =~ s{ " $key " \s* ${ \CONNECTOR } \s* \K ${ \DQ } }
                {${ \DQ_MASK }}xmsg;

    $string =~ s{ ' $key ' \s* ${ \CONNECTOR } \s* \K ${ \SQ } }
                {${ \SQ_MASK }}xmsg;

    return $string;

    }

[download]
(Update: Using 5.10 possessive quantifiers or older, equivalent atomic groupings might make the substitutions slightly faster, but probably only for very long sub-strings.)
Output: 
c:\@Work\Perl\monks\1nickt>perl elide_sensitive_1.pl
ok 1 - '{'password' => 'secret'}' -> '{'password' => '***'}'
ok 2 - '{'password' => 'sec\'ret'}' -> '{'password' => '***'}'
ok 3 - '{"password" => "secret"}' -> '{"password" => "***"}'
ok 4 - '{"password" => "sec\"ret"}' -> '{"password" => "***"}'
ok 5 - '{'password' : 'secret'}' -> '{'password' : '***'}'
ok 6 - '{'password' : 'sec\'ret'}' -> '{'password' : '***'}'
ok 7 - '{"password" : "secret"}' -> '{"password" : "***"}'
ok 8 - '{"password" : "sec\"ret"}' -> '{"password" : "***"}'
ok 9 - '{'user' => 'secret'}' -> '{'user' => '***'}'
ok 10 - '{'user' => 'sec\'ret'}' -> '{'user' => '***'}'
ok 11 - '{"user" => "secret"}' -> '{"user" => "***"}'
ok 12 - '{"user" => "sec\"ret"}' -> '{"user" => "***"}'
ok 13 - '{'user' : 'secret'}' -> '{'user' : '***'}'
ok 14 - '{'user' : 'sec\'ret'}' -> '{'user' : '***'}'
ok 15 - '{"user" : "secret"}' -> '{"user" : "***"}'
ok 16 - '{"user" : "sec\"ret"}' -> '{"user" : "***"}'
1..16
ok 17 - no warnings
1..17

[download]

Give a man a fish:  <%-{-{-{-<

In reply to Re: Matching backslash in regexp negative lookbehind by AnomalousMonk
in thread Matching backslash in regexp negative lookbehind by 1nickt

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.