[rudycelekli]

Bug

The log sanitizer's anthropic_key pattern is \b(sk-ant-[A-Za-z0-9\-]{30,})\b. Anthropic key bodies (sk-ant-api03-…, sk-ant-admin01-…) are base64url, so they contain _ as well as -. A 90+ character body almost always has at least one _.

_ is a word character, so the match cannot end just before it at the trailing \b. The match can only end at a -. The key is then either:

• not matched at all and logged in full, when no - sits 30+ characters in before the first _; or
• masked only up to the last usable -, with the rest of the key logged in clear.

No other pattern catches it in free text. The legacy openai_key branch stops at the - in sk-ant, and high_entropy needs a =/:/quote prefix and also excludes _.

The security pattern set already allows _ (patterns/tokens.go: sk-ant-(?:api03|admin01)-[a-zA-Z0-9_-]{20,}). The log sanitizer was never updated to match.

Trigger

logger.Info("using key sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJ_abcdefghijklmnopqrstuvwx-yzAA for upstream")

On main this line is written unchanged.

Fix

Add _ to the character class.

Test

TestSanitizer_AnthropicKeyWithUnderscore checks three keys with _ at different positions (two api03, one admin01). Each must be masked as sk-ant-api***… / sk-ant-adm***…, and the key body must not appear in the output.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/logs: ok
• With sanitizer.go reverted, the new test fails for all three keys (6 assertion failures).
• gofmt -l internal/logs: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!