fix: apply evidence policy to presentation records

web/apps/console/src/workspace/domain/evidence-policy.test.ts

@@ -38,6 +38,44 @@ describe("evidence policy", () => {
     expect(value.Authorization).toBe(secret);
   });
 
+  it("redacts only the approved sensitive keys with case-insensitive matching", () => {
+    const sanitized = sanitizeEvidenceValue({
+      AUTHORIZATION: "authorization-secret",
+      Cookie: "cookie-secret",
+      "SET-COOKIE": "set-cookie-secret",
+      ToKeN: "token-secret",
+      Access_Token: "access-token-secret",
+      REFRESH_TOKEN: "refresh-token-secret",
+      Secret: "secret-value",
+      PASSWORD: "password-secret",
+      Api_Key: "api-key-secret",
+      "API-KEY": "api-key-secret",
+      tokenCount: 3,
+      authorizationStatus: "ok",
+      cookieJar: "safe",
+      secretary: "safe",
+    }) as Record<string, unknown>;
+
+    for (const key of [
+      "AUTHORIZATION",
+      "Cookie",
+      "SET-COOKIE",
+      "ToKeN",
+      "Access_Token",
+      "REFRESH_TOKEN",
+      "Secret",
+      "PASSWORD",
+      "Api_Key",
+      "API-KEY",
+    ]) {
+      expect(sanitized[key]).toBe("[redacted]");
+    }
+    expect(sanitized.tokenCount).toBe(3);
+    expect(sanitized.authorizationStatus).toBe("ok");
+    expect(sanitized.cookieJar).toBe("safe");
+    expect(sanitized.secretary).toBe("safe");
+  });
+
   it("truncates recursive depth with a stable marker", () => {
     let value: unknown = { leaf: true };
     for (let index = 0; index < 20; index += 1) {

web/apps/console/src/workspace/domain/evidence-policy.ts

@@ -13,8 +13,20 @@ const CIRCULAR_MARKER = "[truncated: circular reference]";
 const UNSUPPORTED_MARKER = "[unsupported: value]";
 const TRUNCATION_KEY = EVIDENCE_LIMIT_MARKER;
 
-const sensitiveKeyPattern =
-  /authorization|cookie|token|password|secret|credential|api[-_]?key|private[-_]?key/i;
+const sensitiveKeys = new Set([
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "token",
+  "access_token",
+  "refresh_token",
+  "secret",
+  "password",
+  "api_key",
+  "api-key",
+]);
+
+const isSensitiveKey = (key: string): boolean => sensitiveKeys.has(key.toLowerCase());
 
 const byteLength = (value: unknown): number => {
   const serialized = JSON.stringify(value);
@@ -95,7 +107,7 @@ const projectValue = (
       if (key === undefined) continue;
       const safeKey = truncateString(key, MAX_STRING_LENGTH);
       // Check the key before reading its value so secrets behind getters or cycles are never traversed.
-      result[safeKey] = sensitiveKeyPattern.test(key)
+      result[safeKey] = isSensitiveKey(key)
         ? REDACTED_MARKER
         : projectValue(readProperty(value, key), depth + 1, active);
     }