Three review findings on the generic credential rule:
- The unbounded name parts around the credential word made the expression rescan the rest of the text after each dot or hyphen. 128,000 characters of `a.` took about 8 seconds, and 256,000 ran past the hook timeout. The name parts are now bounded to 64 characters each, which brings the same input down to about 30 ms.
- A bare value ran to the next whitespace, so `{"token":null,"status":"failed","exit_code":1}` lost its status and exit code. A bare value now ends at the next comma, brace, bracket, semicolon or quote. A JSON object or array value is still redacted to the end.
- A quoted value stopped at an escaped quote, so `{"api_key":"part1\\" part2"}` kept `part2`. Quoted values now skip escaped characters.
L4XB
bc5a38a1a0