fix: redact secrets with underscore suffixes

[Ricky Gummadi (Ricky-G)]

Summary

Redacts complete credential values when an underscore-delimited annotation, such as _old or _rotated, follows the secret.

Fixes #3494.

Problem

Trailing word-boundary assertions rejected fixed-length AWS and Google keys, plus Stripe keys, when a suffix was appended. Basic authentication patterns also used word-boundary anchors that missed underscore-prefixed forms.

Changes

File	What changed
agent-governance-python/agent-os/src/agent_os/credential_redactor.py	Uses mirrored alphanumeric lookarounds for affected credential patterns and corrects Basic-auth anchors.
agent-governance-python/agent-os/tests/test_credential_redactor.py	Adds suffix, Base64-padding, and false-positive regression cases.

Testing

python -m pytest tests\test_credential_redactor.py — 89 passed

python -m ruff check src\agent_os\credential_redactor.py tests\test_credential_redactor.py — passed

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[Carlos Hernandez (carloshvp)]

Reviewed at 721429a. The mirrored boundaries fix the AWS, Google, Stripe, and Basic-auth leak paths while rejecting partial alphanumeric overruns, and the Basic pattern now consumes Base64 padding fully. I ran all 89 credential-redactor tests locally, Ruff and diff checks, an independent boundary matrix, and a 340k-character adversarial scan. I also reproduced the four leaks on current main, verified the agent-os CI jobs passed on Python 3.11 through 3.13, confirmed DCO and CLA, and merge-simulated against current main at 359a233 without conflicts. No blocking findings.

[Imran Siddique (imran-siddique)]

The bug you found is real and your reasoning about the right edge is correct. I ran your branch,
main and #3853 side by side in one process against the same inputs, because #3853 landed on the
same defect independently two days earlier and the two need to be compared rather than merged past
each other.

Your fix works on every pattern it touches. AWS access key, Google API key, Stripe secret key and
both Basic auth branches all go from miss to hit with the annotated suffix, and every negative I
tried still fails to match, so nothing widens.

The gap is the GitHub token pattern, which this branch does not change. It carries
(?![A-Za-z0-9_]), and because _ is excluded there the same failure you fixed elsewhere is still
live:

redact("ghp_AAAAAAAAAAAAAAAAAAAAAAAA_old")
  main   -> ghp_AAAAAAAAAAAAAAAAAAAAAAAA_old
  #3853  -> [REDACTED]_old
  #3855  -> ghp_AAAAAAAAAAAAAAAAAAAAAAAA_old

That covers ghp_, ghs_, gho_, ghu_ and ghr_. A PAT annotated _old or _rotated is a very
ordinary thing to find in a config file, so it is worth closing.

Given that, my read for the maintainers is that #3853 should land, since it is a strict superset:
same mirror assertion on the same patterns, plus the GitHub token line, plus ReDoS tests for the new
lookaheads. Your test_redacts_basic_auth_padding_completely case (auth_Basic YWJjZGVmZ2hpaw==)
already passes there, so nothing you found is lost.

None of that is a criticism of the work. You reached the same diagnosis independently and your
negative cases are good ones. If #3853 goes in first, the useful follow-up from this branch would be
any test case of yours that is not already covered there, rebased down to tests only.

[MohammadHaroonAbuomar]

• agent-governance-python/agent-os/src/agent_os/credential_redactor.py:71 — the GitHub pattern still ends with (?![A-Za-z0-9_]), so a token glued to an underscore suffix (ghp_<36 chars>old) passes through unredacted while the AWS/Google/Stripe/Basic patterns are fixed; please change it to (?![A-Za-z0-9]) and add a ghp…_old case. Note #3853 already covers this superset; consider coordinating. The failing test matrix is environmental (main's typing_extensions pin, fix in #3928) — rebase once that lands.

[MohammadHaroonAbuomar]

Closing as superseded: #3853 landed today and covers the underscore-suffix case for every pattern this PR touched, plus the GitHub token shape this branch missed. Thanks for the fix; feel free to open a follow-up if you see a shape #3853 still misses.