From a8cf73e0765aa7447ca99f3b01ac125f89866dd3 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Mon, 13 Jul 2026 20:20:27 +0200
Subject: [PATCH] fix: redact Sub2API runtime error samples

---
 scripts/src/platform-infra-sub2api-codex/runtime.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/scripts/src/platform-infra-sub2api-codex/runtime.ts b/scripts/src/platform-infra-sub2api-codex/runtime.ts
index 09b9eee7..e5f1b561 100644
--- a/scripts/src/platform-infra-sub2api-codex/runtime.ts
+++ b/scripts/src/platform-infra-sub2api-codex/runtime.ts
@@ -406,7 +406,11 @@ def runtime_log_lines():
 def compact_error(value):
     if not isinstance(value, str):
         return ""
-    return " ".join(value.replace("\x00", "").split())[:240]
+    compact = " ".join(value.replace("\x00", "").split())
+    compact = re.sub(r"(?i)\\bBearer\\s+[A-Za-z0-9._~+/=-]+", "Bearer [REDACTED]", compact)
+    compact = re.sub(r"\\bsk-[A-Za-z0-9_-]{8,}\\b", "sk-[REDACTED]", compact)
+    compact = re.sub(r"(?i)\\b(api[_ -]?key|token)[=:]\\s*[^\\s,;]+", r"\\1=[REDACTED]", compact)
+    return compact[:240]
 
 def observed_runtime_errors(accounts):
     selector = PAYLOAD.get("account")