fix(redaction): keep prefixed secret keys masked while leaving Infisical's bare secretKey visible

Author: waleedlatif1

apps/sim/lib/core/security/redaction.test.ts

@@ -31,6 +31,10 @@ describe('isSensitiveKey', () => {
     'exa_api_key',
     'secretAccessKey',
     'awsSecretAccessKey',
+    'bedrockSecretKey',
+    'apiSecretKey',
+    'clerkSecretKey',
+    'stripe_secret_key',
     'deployKey',
     'convexDeployKey',
     `${'a'.repeat(10000)}password`,

apps/sim/lib/core/security/redaction.ts

@@ -29,8 +29,11 @@ const SENSITIVE_KEY_PATTERNS: RegExp[] = [
   /^.*api[_-]?key$/i,
   // AWS's `secretAccessKey` / `awsSecretAccessKey`, which no suffix above covers.
   /^.*secret[_-]?access[_-]?key$/i,
-  // Convex's `deployKey`. A bare `secretKey` is left out: Infisical returns each
-  // secret's name in that field, and redacting it would hide every listed name.
+  // Prefixed secret keys such as Bedrock's `bedrockSecretKey` and Clerk's `clerkSecretKey`.
+  // The prefix is required: Infisical returns each secret's name in a bare `secretKey`
+  // field, and redacting it would hide every listed name.
+  /^.+secret[_-]?key$/i,
+  // Convex's `deployKey`.
   /^.*deploy[_-]?key$/i,
   /^passphrase$/i,
   /^authorization$/i,

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -184,9 +184,10 @@ async function sendThroughEgress(
   { url, method = 'GET', headers, body }: TokenCheckRequest
 ): Promise<ProviderResponse> {
   // A forward proxy re-resolves the host, so the transport refuses one with any refused record.
+  // An unparseable URL skips the proxy lookup; validation then refuses it as the user's input.
   const validation = await validateUrlWithDNS(url, 'url', profile, {
     logDetails: false,
-    requireEveryAddress: resolveEnvironmentProxy(new URL(url)) !== null,
+    requireEveryAddress: URL.canParse(url) && resolveEnvironmentProxy(new URL(url)) !== null,
   })
   if (!validation.isValid) {
     if (validation.refusal !== 'dns') throw hostNotAllowed()