From 716563e67152a55df0bd869cf8c11a12bc4a81c9 Mon Sep 17 00:00:00 2001 From: Ayush7614 Date: Wed, 2 Sep 2026 14:11:55 +0530 Subject: [PATCH] fix(audit): redact camelCase toolResult and toolArguments in audit trail Tool results and arguments were only redacted under snake_case tool_result/tool_arguments, but audit payloads also carry them as toolResult/toolArguments (direct MCP and computer tool calls). The normalized check fell through because the set lacked the stripped forms toolresult/toolarguments, so plaintext secrets leaked into audit_events.payload. Add the two missing normalized keys so both spellings are covered. Verified with redactAuditPayload unit probes: snake, camel, nested, and upper-case variants now all return [REDACTED]. --- server/src/audit.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/server/src/audit.ts b/server/src/audit.ts index c92f89fd9..22c75acb0 100644 --- a/server/src/audit.ts +++ b/server/src/audit.ts @@ -29,7 +29,9 @@ const sensitiveKeys = new Set([ "token", "tokens", "tool_arguments", + "toolarguments", "tool_result", + "toolresult", ]); export const auditEventTypes = [