fix: redact temporary AWS credentials

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+- Redact temporary AWS access keys and `aws_session_token` assignments found in logs.
+- Add regression coverage for both credential formats.
+- Refresh the browser script URL so hosted clients load the updated core.
+
 ## v1.0.11 — 2026-10-13
 
 - Keep distinct uploaded logs even when their sanitized names and sizes match; exact duplicate content is still skipped.

index.html

@@ -8,7 +8,7 @@
   <title>BugBundle — Share the signal, not your secrets</title>
   <link rel="icon" href="assets/favicon.svg" type="image/svg+xml">
   <link rel="stylesheet" href="styles.css?v=8">
-  <script type="module" src="src/app.js?v=10"></script>
+  <script type="module" src="src/app.js?v=11"></script>
 </head>
 <body>
   <header class="topbar">

src/core.js

@@ -1,7 +1,7 @@
 const RULES = [
   ['Private key', /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/g],
   ['GitHub token', /\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g],
-  ['AWS access key', /\bAKIA[0-9A-Z]{16}\b/g],
+  ['AWS access key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
   ['Google API key', /\bAIza[0-9A-Za-z_-]{30,}\b/g],
   ['Slack token', /\bxox[baprs]-[0-9A-Za-z-]{20,}\b/g],
   ['Discord webhook', /https?:\/\/(?:discord(?:app)?\.com)\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9._-]{20,}/gi],
@@ -70,7 +70,7 @@ export function redact(text, options = {}) {
     const octet = '(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
     countReplace('IPv4 address', new RegExp(`\\b${octet}(?:\\.${octet}){3}\\b`, 'g'), () => '[IP ADDRESS]');
   }
-  countReplace('Credential assignment', /["']?\b(password|passwd|api[_-]?key|access[_-]?token|client[_-]?secret|aws_secret_access_key|secret|token)\b["']?\s*([:=])\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'`]+)/gi,
+  countReplace('Credential assignment', /["']?\b(password|passwd|api[_-]?key|access[_-]?token|client[_-]?secret|aws_secret_access_key|aws_session_token|secret|token)\b["']?\s*([:=])\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;"'`]+)/gi,
     (...args) => `${args[1]}${args[2]}[REDACTED]`);
   countReplace('Discord webhook', /https?:\/\/(?:discord(?:app)?\.com)\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9._-]{20,}/gi, () => '[REDACTED WEBHOOK]');
   return { text: output, counts };

test/core.test.js

@@ -32,6 +32,15 @@ test('redacts common credentials, emails, and user profile paths', () => {
   assert.equal(result.counts['Authorization token'], 1);
 });
 
+test('redacts temporary AWS access keys and session-token assignments', () => {
+  const input = 'AWS_ACCESS_KEY_ID=ASIA1234567890ABCDEF\naws_session_token=temporary-session-secret-123';
+  const result = redact(input);
+
+  assert.doesNotMatch(result.text, /ASIA1234567890ABCDEF|temporary-session-secret-123/);
+  assert.equal(result.counts['AWS access key'], 1);
+  assert.equal(result.counts['Credential assignment'], 1);
+});
+
 test('redacts webhook URLs and JSON-style apiKey assignments', () => {
   const input = [
     'https://discord.com/api/webhooks/123456789012345678/abcdefghijklmnopQRSTUVwx',