[waleedlatif1]

Summary

• Redaction: fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy #9864 was meant to drop its bare secretKey pattern after review (Infisical returns each secret's name in secretKey), but that commit never reached the PR before it was squash-merged. Staging therefore redacts every Infisical secret name in persisted logs and console output. This restores the reviewed version: only Convex's deployKey is added, and secretKey is back on the non-sensitive list with the reason in the comment
• Networking docs: line 268 still said the SSRF guard reads the proxy variables "with the same rules" as Bun's fetch, which fix(release): keyless subject uniqueness, NO_PROXY IPv6/CIDR, proxied boot secret, and remaining audit follow-ups #9866's curl-style NO_PROXY matching made untrue. It now says the guard matches like curl and links to the section that explains both

Type of Change

• Bug fix

Testing

• bunx vitest run lib/core/security/redaction.test.ts — 76 passed; restoring the secretKey pattern turns the secretKey non-sensitive case red
• check:docs, check:site-urls
• lint:check + type-check via the pre-push hook; full gate left to CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Building	Preview	Nov 11, 2026 12:37am UTC

[waleedlatif1]

Folded into the single round-2 release cleanup PR (fix/release-final-leftovers-1110), which takes both commits here unchanged: the reviewed secretKey redaction fix and the networking.mdx NO_PROXY wording. Closing so there is one PR.

[greptile-apps]

Confidence Score: 3/5

[Critical impact] The PR changes a shared redaction rule used across several ways people inspect run data.

Restore masking for bedrockSecretKey before merging so AWS credentials do not appear in logged inputs.

Findings

1.   Bedrock keys appear in logs ▶

Summary

This PR keeps Infisical secret names visible and corrects the outbound proxy documentation.

• Infisical secret names stay visible while Convex deploy keys stay masked.
• The networking guide explains the SSRF guard's curl-style NO_PROXY matching.

waleedlatif1 explicitly states that keeping bare secretKey visible is intentional because Infisical uses that field for secret names.

_{Reviews (1) · Last reviewed commit: "docs(networking): the SSRF guard matches..." · Reviewed by Greptile}

[greptile-apps]

Bedrock keys appear in logs

Removing the whole secretKey suffix pattern also stops hiding bedrockSecretKey, which holds an AWS secret access key. When a user types that key directly into a Bedrock block, the resolver keeps the literal value and the block logger passes it through redactApiKeys. The key now appears in logged inputs and the console.

Keep bare secretKey visible for Infisical, but retain coverage for credential fields such as bedrockSecretKey and restore its regression test.

How this was verified: The Bedrock password field flows into logged block inputs, while the placeholder projection preserves directly typed values and the remaining key patterns do not match bedrockSecretKey.