Tokens and passwords caught in error text are now redacted before you or your logs see them.
What's wrong with this entry?
Short error and detail summaries are run through a redactor before display, so tokens pasted into error strings do not leak into output or logs.
- Rewrites bearer and basic values, and token/key/secret/password/authorization/credential assignments of 8 or more characters, to "[redacted]".
- Runs after a byte-safe truncation of the summary.
- Unconditional; no gate.
/\b(bearer|basic)[\s:=\uFF1A\uFF1D]+([A-Za-z0-9._~+/=%-]{8,})/gi
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.248
Crashed sessions write a structured diagnostic line to the transcript
Both mention error handling
-
v2.1.248
Error detail is withheld when a session's output leaves the machine
Both mention error handling
-
v2.1.248
Named errors for skill search, message sending and image resizing
Both mention error handling