fix: fully redact custom credentials in key inventory

2026-10-29 04:59:07 +02:00
parent b48821309b
commit 6158723563
4 changed files with 33 additions and 3 deletions
@@ -10,7 +10,8 @@
 * tests/auth-provider-keys.test.ts) — the settings UI reads it optionally
 * with a graceful fallback.
 *
- * Masked only — last 4 + length; PLAINTEXT NEVER LEAVES THE STORE THROUGH
+ * Masked only — last 4 + length for ordinary keys; custom keys are fully
+ * redacted at every length (no credential suffix). PLAINTEXT NEVER LEAVES THE STORE THROUGH
 * THIS API (owner decision). `source` tells the page whether the live
 * value comes from the environment (dev .env.local / launch env) or the
 * file, and `shadowedByEnv` explains why a saved key is not the live one