@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2024-2026 FlossWare
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package org.flossware.platform.api;
+
+import java.util.regex.Pattern;
+
+/**
+ * Utility for masking sensitive credentials in logs and error messages.
+ *
+ * <p>Prevents accidental exposure of passwords, tokens, API keys, and other sensitive data in
+ * logging output.
+ *
+ * <p>Patterns masked:
+ *
+ * <ul>
+ *   <li>password=xxx
+ *   <li>token=xxx
+ *   <li>apikey=xxx
+ *   <li>api_key=xxx
+ *   <li>Authorization: Bearer xxx
+ *   <li>Basic base64-encoded-credentials
+ * </ul>
+ *
+ * <p>Thread Safety: This class is thread-safe.
+ *
+ * @since 1.1
+ */
+public final class CredentialMasker {
+
+  private static final String MASKED_VALUE = "***MASKED***";
+
+  // Regex patterns for common credential patterns
+  private static final Pattern PASSWORD_PATTERN =
+      Pattern.compile("password[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+  private static final Pattern TOKEN_PATTERN =
+      Pattern.compile("token[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+  private static final Pattern API_KEY_PATTERN =
+      Pattern.compile(
+          "api[_\\s-]?key[\"']?\\s*[:=]\\s*[\"']?([^\"'\\s,}]+)", Pattern.CASE_INSENSITIVE);
+  private static final Pattern BEARER_PATTERN =
+      Pattern.compile("Bearer\\s+([^\\s]+)", Pattern.CASE_INSENSITIVE);
+  private static final Pattern BASIC_AUTH_PATTERN = Pattern.compile("Basic\\s+([^\\s]+)");
+  private static final Pattern ENV_VAR_PATTERN = Pattern.compile("\\$\\{([A-Z0-9_]+)\\}");
+
+  private CredentialMasker() {
+    // Utility class
+  }
+
+  /**
+   * Masks sensitive credentials in the given message.
+   *
+   * @param message the message that may contain credentials
+   * @return the message with credentials masked
+   */
+  public static String mask(String message) {
+    if (message == null || message.isEmpty()) {
+      return message;
+    }
+
+    String masked = message;
+
+    // Mask password values
+    masked = PASSWORD_PATTERN.matcher(masked).replaceAll("password=" + MASKED_VALUE);
+
+    // Mask token values
+    masked = TOKEN_PATTERN.matcher(masked).replaceAll("token=" + MASKED_VALUE);
+
+    // Mask API key values
+    masked = API_KEY_PATTERN.matcher(masked).replaceAll("api_key=" + MASKED_VALUE);
+
+    // Mask Bearer tokens
+    masked = BEARER_PATTERN.matcher(masked).replaceAll("Bearer " + MASKED_VALUE);
+
+    // Mask Basic auth
+    masked = BASIC_AUTH_PATTERN.matcher(masked).replaceAll("Basic " + MASKED_VALUE);
+
+    // Mask environment variable references (but not the variable name)
+    masked = ENV_VAR_PATTERN.matcher(masked).replaceAll("\\$\\{$1\\}");
+
+    return masked;
+  }
+
+  /**
+   * Masks a specific credential value.
+   *
+   * @param credentialValue the credential value to mask
+   * @return a masked version of the credential
+   */
+  public static String maskValue(String credentialValue) {
+    if (credentialValue == null || credentialValue.isEmpty()) {
+      return credentialValue;
+    }
+    // Show first character and last character only for debugging
+    if (credentialValue.length() <= 2) {
+      return MASKED_VALUE;
+    }
+    return credentialValue.charAt(0) + "..." + credentialValue.charAt(credentialValue.length() - 1);
+  }
+}