Found during v0.9.1 release review (CTO). Telemetry.maskString() only redacts known shapes (sk-…, Bearer , emails, hosts). A verbose auth CLI in headersCommand that prints a bare unprefixed token to stderr on failure would surface unmasked in status.error/mcp list/logs. Consider entropy-based redaction for the headersCommand failure path, or document the residual risk.
Found during v0.9.1 release review (CTO).
Telemetry.maskString()only redacts known shapes (sk-…, Bearer , emails, hosts). A verbose auth CLI inheadersCommandthat prints a bare unprefixed token to stderr on failure would surface unmasked instatus.error/mcp list/logs. Consider entropy-based redaction for the headersCommand failure path, or document the residual risk.