From 4a3ab73918e11ff8c3f21d01285099c8bff84645 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:09:37 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20sensitive=20object=20key=20redaction=20bypass?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .Jules/sentinel.md          |  4 ++++
 src/core/utils/sanitizer.ts | 14 ++++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100644 .Jules/sentinel.md

diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md
new file mode 100644
index 00000000..5900b7b1
--- /dev/null
+++ b/.Jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-08-31 - Add explicit sensitive key redaction in sanitizeObject
+**Vulnerability:** The `sanitizeObject` utility redacted entire `headers` or `request` objects but failed to redact specific sensitive keys (like `authorization`, `password`, or `token`) if they were logged independently or at the top level of an object structure.
+**Learning:** Hardcoded blacklists must account for individual sensitive fields, not just container objects, to prevent partial credential leaks in unstructured logs.
+**Prevention:** Expanded the blacklist in `sanitizeObject` to include common sensitive keywords (`authorization`, `password`, `token`, etc.) and implemented case-insensitive matching (`toLowerCase()`) to catch variants.
diff --git a/src/core/utils/sanitizer.ts b/src/core/utils/sanitizer.ts
index e58cd10f..cafe28a2 100644
--- a/src/core/utils/sanitizer.ts
+++ b/src/core/utils/sanitizer.ts
@@ -104,14 +104,20 @@ export function sanitizeObject(obj: any, maxDepth = MAX_DEPTH, depth = 0): any {
     // Blacklisted fields that contain raw request/response data that should be completely hidden
     if (
       [
-        'requestBodyValues',
-        'requestBody',
+        'requestbodyvalues',
+        'requestbody',
         'headers',
-        'responseHeaders',
+        'responseheaders',
         'request',
         'stack',
         'url',
-      ].includes(keyStr)
+        'authorization',
+        'password',
+        'token',
+        'secret',
+        'cookie',
+        'credential',
+      ].includes(keyStr.toLowerCase())
     ) {
       result[key] = '[HIDDEN FOR SECURITY]';
       continue;