diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md
new file mode 100644
index 00000000..5900b7b1
--- /dev/null
+++ b/.Jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-31 - Add explicit sensitive key redaction in sanitizeObject
+**Vulnerability:** The `sanitizeObject` utility redacted entire `headers` or `request` objects but failed to redact specific sensitive keys (like `authorization`, `password`, or `token`) if they were logged independently or at the top level of an object structure.
+**Learning:** Hardcoded blacklists must account for individual sensitive fields, not just container objects, to prevent partial credential leaks in unstructured logs.
+**Prevention:** Expanded the blacklist in `sanitizeObject` to include common sensitive keywords (`authorization`, `password`, `token`, etc.) and implemented case-insensitive matching (`toLowerCase()`) to catch variants.
diff --git a/src/core/utils/sanitizer.ts b/src/core/utils/sanitizer.ts
index e58cd10f..cafe28a2 100644
--- a/src/core/utils/sanitizer.ts
+++ b/src/core/utils/sanitizer.ts
@@ -104,14 +104,20 @@ export function sanitizeObject(obj: any, maxDepth = MAX_DEPTH, depth = 0): any {
     // Blacklisted fields that contain raw request/response data that should be completely hidden
     if (
       [
-        'requestBodyValues',
-        'requestBody',
+        'requestbodyvalues',
+        'requestbody',
         'headers',
-        'responseHeaders',
+        'responseheaders',
         'request',
         'stack',
         'url',
-      ].includes(keyStr)
+        'authorization',
+        'password',
+        'token',
+        'secret',
+        'cookie',
+        'credential',
+      ].includes(keyStr.toLowerCase())
     ) {
       result[key] = '[HIDDEN FOR SECURITY]';
       continue;