Repository navigation
Conversation
Debug network evidence masked a header only when its whole name was in the fixed secret list, so common vendor credential headers kept their values: GitLab `PRIVATE-TOKEN`, Google `x-goog-api-key`, AWS `x-amz-security-token`, Azure `Ocp-Apim-Subscription-Key`, Vault `x-vault-token`, `x-access-token` and `x-client-secret`. JSON body fields such as `private_token` were kept the same way. A name whose last part is token, api key, secret, subscription key or password is now treated as secret too. Assisted-by: Claude Code
NianJiuZst
self-requested a review
November 3, 2026 06:09
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Debug network evidence masks a header only when its whole lowercase name is in the fixed
SECRETlist (authorization,cookie,x-api-key,x-auth-token, ...). Common vendor credential headers are not in it, so their values were retained as sent:PRIVATE-TOKENx-goog-api-keyx-amz-security-tokenOcp-Apim-Subscription-Keyx-vault-token, plusx-access-tokenandx-client-secretJSON body fields with the same shape (
private_token,x_goog_api_key) were kept the same way. A name whose last-/_part istoken,api key,secret,subscription keyorpasswordis now treated as secret too, for headers and for URL/JSON field names. Ordinary headers such asx-request-id,idempotency-keyandx-tokenizerare unchanged.Tests
New cases in
apps/extension/src/debug/__tests__/redact.test.ts: the seven headers above, the two JSON fields, and four ordinary headers that must stay as they are. The eight secret cases fail without the change inredact.tsand pass with it.pnpm --filter @browser-skill/extension test: 195 files, 3580 tests passednpx biome check .: cleantsc --noEmitinapps/extension: cleanI used Claude Code to find this, write the fix and tests, and run the checks above.