From 7505b3b2719b65757206937324e57429cadba225 Mon Sep 17 00:00:00 2001
From: "devin-ai-integration[bot]"
 <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 20:26:58 -0300
Subject: [PATCH] feat: add missing sensitive fields to redactSensitiveData
 (#24121)

- Add private_key, encrypted_credentials, tenant_id, client_email, serviceAccountKey to SENSITIVE_FIELDS array
- Add comprehensive test cases for delegation credential sensitive fields
- Prevents logging of sensitive delegation credential data including private keys

Fixes security issue where delegation credential sensitive fields were not being redacted from logs

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: morgan@cal.com <morgan@cal.com>
Co-authored-by: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
---
 packages/lib/redactSensitiveData.test.ts | 49 +++++++++++++++++++++++-
 packages/lib/redactSensitiveData.ts      |  5 +++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/packages/lib/redactSensitiveData.test.ts b/packages/lib/redactSensitiveData.test.ts
index 835907fda0..776bd2dc6b 100644
--- a/packages/lib/redactSensitiveData.test.ts
+++ b/packages/lib/redactSensitiveData.test.ts
@@ -150,7 +150,7 @@ describe("redactSensitiveData", () => {
   });
 
   it("should handle circular references gracefully", () => {
-    const input: any = { name: "test" };
+    const input: Record<string, unknown> = { name: "test" };
     input.self = input;
     expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
       {
@@ -175,4 +175,51 @@ describe("redactSensitiveData", () => {
       }
     `);
   });
+
+  it("should redact delegation credential sensitive fields", () => {
+    const input = {
+      serviceAccountKey: {
+        client_id: "client123",
+        client_email: "service@example.com",
+        private_key: "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...",
+        tenant_id: "tenant123",
+      },
+      encrypted_credentials: "encrypted_data_here",
+      normalField: "value",
+    };
+    expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
+      {
+        "encrypted_credentials": "[REDACTED]",
+        "normalField": "value",
+        "serviceAccountKey": "[REDACTED]",
+      }
+    `);
+  });
+
+  it("should redact nested delegation credential fields", () => {
+    const input = {
+      credential: {
+        delegatedTo: {
+          serviceAccountKey: {
+            private_key: "sensitive_key",
+            client_email: "service@example.com",
+            tenant_id: "tenant123",
+          },
+        },
+      },
+      config: {
+        private_key: "another_private_key",
+        client_email: "another@example.com",
+      },
+    };
+    expect(redactSensitiveData(input)).toMatchInlineSnapshot(`
+      {
+        "config": {
+          "client_email": "[REDACTED]",
+          "private_key": "[REDACTED]",
+        },
+        "credential": "[REDACTED]",
+      }
+    `);
+  });
 });
diff --git a/packages/lib/redactSensitiveData.ts b/packages/lib/redactSensitiveData.ts
index 683bc49a57..aada55098e 100644
--- a/packages/lib/redactSensitiveData.ts
+++ b/packages/lib/redactSensitiveData.ts
@@ -7,14 +7,19 @@ const SENSITIVE_FIELDS = [
   "apiKey",
   "auth",
   "authorization",
+  "client_email",
   "client_id",
   "client_secret",
   "credential",
+  "encrypted_credentials",
   "hash",
   "key",
   "password",
+  "private_key",
   "refreshToken",
   "secret",
+  "serviceAccountKey",
+  "tenant_id",
   "token",
 ];