From 7a5d3ae5ce9bf7b1354decba22d7e0dd9ca7a22d Mon Sep 17 00:00:00 2001
From: imccyu <276526105+imccyu@users.noreply.github.com>
Date: Sat, 18 Jul 2026 21:56:52 +0800
Subject: [PATCH] fix(telemetry): stop bearer redaction from eating plain prose

The bearer rule matched any 8+ run of letters after the word, so
package.json prose like "uses bearer authentication" lost its
following word to the placeholder. Real bearer credentials always
carry a digit; require one in the candidate token.
---
 packages/sdk/telemetry/src/secret-redactor.ts        | 7 ++++++-
 packages/sdk/telemetry/tests/secret-redactor.spec.ts | 7 +++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/packages/sdk/telemetry/src/secret-redactor.ts b/packages/sdk/telemetry/src/secret-redactor.ts
index 5b9af5f169..087ba2284a 100644
--- a/packages/sdk/telemetry/src/secret-redactor.ts
+++ b/packages/sdk/telemetry/src/secret-redactor.ts
@@ -191,7 +191,12 @@ export class SecretRedactor {
   }
 
   #redactBearerTokens(text: string): string {
-    return text.replace(/(bearer\s+)([a-z0-9._-]{8,})/gi, (_match, prefix: string) => `${prefix}${this.#placeholder}`)
+    // The candidate must contain a digit: real bearer credentials are never
+    // letters-only, while prose like "bearer authentication" is.
+    return text.replace(
+      /(bearer\s+)((?=[a-z._-]*[0-9])[a-z0-9._-]{8,})/gi,
+      (_match, prefix: string) => `${prefix}${this.#placeholder}`,
+    )
   }
 
   #redactStandaloneTokens(text: string): string {
diff --git a/packages/sdk/telemetry/tests/secret-redactor.spec.ts b/packages/sdk/telemetry/tests/secret-redactor.spec.ts
index c3250d9ace..77d89d968e 100644
--- a/packages/sdk/telemetry/tests/secret-redactor.spec.ts
+++ b/packages/sdk/telemetry/tests/secret-redactor.spec.ts
@@ -154,6 +154,13 @@ describe('SecretRedactor.redactText', () => {
       .toBe(`sending Bearer ${REDACTED} now`)
   })
 
+  it('keeps letters-only prose after the word bearer intact', () => {
+    expect(redactor.redactText('uses bearer authentication for requests'))
+      .toBe('uses bearer authentication for requests')
+    expect(redactor.redactText('"description": "bearer token-helper middleware"'))
+      .toBe('"description": "bearer token-helper middleware"')
+  })
+
   it('redacts standalone secret-shaped tokens while keeping package names and paths', () => {
     expect(redactor.redactText('key sk-abcdefghij1234567890 end'))
       .toBe(`key ${REDACTED} end`)