[rudycelekli]

Bug

The log sanitizer's github_token pattern is \b(gh[poushr]_[A-Za-z0-9]{36,})\b. It does not cover fine-grained personal access tokens (github_pat_<id>_<secret>), which is the format GitHub creates by default and the one the GitHub MCP server docs tell people to put in GITHUB_PERSONAL_ACCESS_TOKEN.

No other pattern catches the token in free text. bearer_token only applies after Bearer , and high_entropy needs a =/:/quote prefix and excludes _, so its 30+ character run never starts right after the prefix.

The security pattern set already matches this format (patterns/tokens.go: github_pat_[a-zA-Z0-9]+_[a-zA-Z0-9]{30,}). The log sanitizer never got the same branch.

Trigger

logger.Info("token=github_pat_11ABCDEFG0123456789abcd_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456")

On main this line is written unchanged.

Fix

Add a github_pat_[A-Za-z0-9]+_[A-Za-z0-9]{30,} branch to github_token. It uses the same shape as the security pattern and the existing mask (github_***<last2>).

Test

A fine-grained case was added to TestSanitizer_GitHubTokens. The leak check now looks for the token body (token[12:]) instead of the whole token, so a partial mask can't pass.

Commands run

• CGO_ENABLED=0 go test -count=1 ./internal/logs: ok
• With sanitizer.go reverted, TestSanitizer_GitHubTokens/fine-grained_github_pat_ fails with token leaked unmasked.
• gofmt -l internal/logs: no output

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!