You'll notice
Useful3 Signal2
Crash reports now strip more token types, including GitHub fine-grained tokens and Slack cookies.
What's wrong with this entry?
Anonymous. No account, no email.
What
The scrubber that strips secrets from error reports now recognises GitHub fine-grained personal access tokens, Square keys, Meta/Facebook long-lived tokens, Slack browser cookies (xoxc/xoxd) and OpenAI project and service-account keys. Applies to every crash and error report, with no flag.
Details
- Slack, GitLab and GitHub patterns are now produced by a shared regex builder covering percent-encoded and URL-safe alphabets, fronted by cheap pre-scan checks so the expensive patterns only run when a candidate is present.
- AWS key patterns now anchor on a non-alphanumeric boundary rather than a word boundary, catching keys embedded in longer strings.
- The per-process cap on reports and its "already reported" marker moved from module-level variables onto an instance object.
Evidence
/sq0(?:atp|csp)-[A-Za-z0-9_-]{22,}/g
Strings lifted out of the shipped bundle, so the claim above can be checked against them.