Function SanitizeErrorMessage

pkg/stringutil/sanitize.go:174–203

SanitizeErrorMessage removes potential secret key names from error messages to prevent information disclosure via logs. This prevents exposing details about an organization's security infrastructure by redacting secret key names that might appear in error messages.

(message string)

// information disclosure via logs. This prevents exposing details about an organization's
// security infrastructure by redacting secret key names that might appear in error messages.
func SanitizeErrorMessage(message string) string {
	if message == "" {
		return message
	}

	sanitizeLog.Printf("Sanitizing error message: length=%d", len(message))

	// Redact uppercase snake_case patterns (e.g., MY_SECRET_KEY, API_TOKEN)
	sanitized := secretNamePattern.ReplaceAllStringFunc(message, func(match string) string {
		// Don't redact common workflow keywords
		if _, ok := commonWorkflowKeywords[match]; ok {
			return match
		}
		// Don't redact gh-aw public configuration variables (e.g., GH_AW_SKIP_NPX_VALIDATION)
		if strings.HasPrefix(match, "GH_AW_") {
			return match
		}
		sanitizeLog.Printf("Redacted snake_case secret pattern: %s", match)
		return "[REDACTED]"
	})

	// Redact PascalCase patterns ending with security suffixes (e.g., GitHubToken, ApiKey)
	sanitized = pascalCaseSecretPattern.ReplaceAllString(sanitized, "[REDACTED]")

	if sanitized != message {
		sanitizeLog.Print("Error message sanitization applied redactions")
	}

	return sanitized
}

// SanitizeIdentifierName sanitizes a name for use as a programming-language identifier
// by replacing disallowed characters with underscores.