[sentry-junior]

Closes credential leaks that a probe audit found in sample text, miss text and the recording request.url. Every leak below also happens on main. Recording keys don't change: request-key.ts has no diff, and the pinned key tests pass.

What changes in secrets.ts

• Fail closed on more bodies. These now withhold the sample instead of keeping the credential:
  • JSON or XML sent with a form content type
  • a top-level JSON string
  • an escaped key such as pass\u0077ord in invalid JSON
  • a bare ghp_… or JWT in text/plain or invalid JSON
  • URL-escaped JSON inside a form value
  • a % that can't be decoded, which no longer turns off the escape check
• Nested form names. password[], user[password][0] and user%5Bpassword%5D now match on their last bracket part that isn't empty and isn't a number. Every part of a form name, credential fields included, is checked for a known value or a token prefix. A non-credential field whose value may show a credential, including a bare token, withholds the sample. grant_type=password and refresh_token keep their text.
• Array, object and number credentials. Each string inside the value is redacted in place, and copies of it elsewhere in the body and in ?q= are redacted too. A number anywhere in a credential value withholds the sample, and a copy of the number in the recording URL is redacted.
• JWTs. A linear scanner replaces the JWT regex. It catches a JWT after _, - or an alphanumeric character, and a JWT with - in its header.
• Field-kind cache. The cache clears when it is full, so a large first body no longer leaves later bodies without a cache.
• Recording URL. recorder.ts now redacts a copy of a body credential in the recording's request.url.

Trade-offs

• These bodies now withhold the sample, so they lose debug text only:
  • RFC 7523 and RFC 8693 *_type OAuth bodies
  • a base64url run followed by .eyJ
• Tool schemas with a password property show "type":"<<redacted>>" in samples.
• The worst adversarial 16 MiB form takes about 2.8 s to redact against the 9 s key time limit. It stays linear and fails closed.
• Copies of a credential in free text, and in escaped or percent-encoded forms, are still a documented gap. The README says so.

Verification

• pnpm check passes on Node 24: 114 tests, lint clean, knip clean.
• I reverted each fix on its own, and a test in redaction.test.ts failed each time.
• An independent reviewer did two rounds of adversarial probes through the real sample path: keyRequest, then redactRequestWith / redactRequestUrl. The final verdict was approve, with no must-fix items.
• The remaining nits are adversarial only:
  • a form name with a % that can't be decoded
  • a known value split across bracket parts
  • a percent-encoded . or J inside a JWT

refactor/service-split (move-only) is stacked on this branch.

via @dcramer.

--

View Session [Sentry]