Alec Barber bab7c2dcc1 Improve bearer token secret redaction (#36908) ...

## Why

Bearer credentials can contain characters outside the previous token pattern or
start with another recognized key prefix. This could leave part of the
credential visible after redaction.

## What changed

- Recognize bearer tokens containing URL-safe and base64-style characters,
  optional padding, and horizontal whitespace after the scheme.
- Redact bearer credentials before matching narrower OpenAI and AWS key forms so
  the whole credential is replaced.
- Preserve delimiters following the credential and avoid matching short tokens,
  joined scheme names, or tokens separated by vertical or non-ASCII whitespace.

## Testing

Added focused positive and negative cases for the supported token forms and
false-positive boundaries.

GitOrigin-RevId: 1e5b10685281dc91d232d619b938bacbadaa47f9

2026-08-04 15:14:57 +00:00

..

src

Improve bearer token secret redaction (#36908)

2026-08-04 15:14:57 +00:00

BUILD.bazel

…

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00