mirror of
https://github.com/safishamsi/graphify.git
synced 2026-10-25 16:22:30 +00:00
Follow-up to #4566. Adds an opaque (non-JWT) `Bearer <token>` shape to the credential redactor so `Authorization: Bearer <opaque>` is redacted (the JWT form was already caught by the eyJ pattern); the word "Bearer" is kept, only the token is replaced. Adds an over-redaction regression test proving a 40-char git SHA, a sha256 digest and a UUID pass through untouched, so the redactor never mangles the ordinary high-entropy identifiers that appear in real rationale labels. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>