fix(redaction): keep Infisical secret names visible; redact only deployKey

Author: waleedlatif1

apps/sim/lib/core/security/redaction.test.ts

@@ -31,9 +31,8 @@ describe('isSensitiveKey', () => {
     'exa_api_key',
     'secretAccessKey',
     'awsSecretAccessKey',
-    'secretKey',
-    'bedrockSecretKey',
     'deployKey',
+    'convexDeployKey',
     `${'a'.repeat(10000)}password`,
   ])('treats %s as sensitive', (key) => {
     expect(isSensitiveKey(key)).toBe(true)
@@ -42,7 +41,7 @@ describe('isSensitiveKey', () => {
   it.concurrent.each([
     'tokenCount',
     'tokenizer',
-    'secretKeyId',
+    'secretKey',
     'deployKeyName',
     'passwordStrength',
     'authMethod',

apps/sim/lib/core/security/redaction.ts

@@ -29,9 +29,8 @@ const SENSITIVE_KEY_PATTERNS: RegExp[] = [
   /^.*api[_-]?key$/i,
   // AWS's `secretAccessKey` / `awsSecretAccessKey`, which no suffix above covers.
   /^.*secret[_-]?access[_-]?key$/i,
-  // Credential fields named for the key itself: Clerk's `secretKey`, Bedrock's
-  // `bedrockSecretKey`, and Convex's `deployKey`.
-  /^.*secret[_-]?key$/i,
+  // Convex's `deployKey`. A bare `secretKey` is left out: Infisical returns each
+  // secret's name in that field, and redacting it would hide every listed name.
   /^.*deploy[_-]?key$/i,
   /^passphrase$/i,
   /^authorization$/i,