fix: fully redact custom credentials in key inventory

2026-10-29 04:59:07 +02:00
parent b48821309b
commit 6158723563
4 changed files with 33 additions and 3 deletions
@@ -207,7 +207,8 @@ export interface AuthKeyStatus {
 	info: AuthKeyInfo | null;
 	/** A key is present when EITHER the environment or the file has it. */
 	present: boolean;
-	/** The masked tail + character count, e.g. "…ab12 (64 chars)". */
+	/** Ordinary masked tail + count, e.g. "…ab12 (64 chars)"; custom keys
+	 * use full redaction, with no credential characters at any length. */
 	masked: string | null;
 	/** Where the live value comes from, given env-wins precedence. */
 	source: "env" | "file" | "none";