Environment values that look like tokens are redacted much more reliably now.
What's wrong with this entry?
The check that decides whether a value looks like a secret, used to redact environment variables before they are recorded, now recognizes common token prefixes including ghp_-style GitHub tokens, github_pat_, glpat-, Slack xox tokens, sk-, pk-, AKIA, JWTs starting eyJ, ya29. and npm_, plus any string of 20 characters or more mixing letters and digits. It replaces a much narrower earlier scheme.
gh[opusr]_|github_pat_|glpat-|xox[abpr]-|sk-|pk-|AKIA|eyJ|ya29
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.223
Credentials stripped from the git remote URL sent to the bridge
Both mention privacy