Fix secret prefix preservation vulnerability (CWE-200)

[Copilot]

Secret redaction was preserving the first 3 characters of tokens, leaking service identification (ghp_ → GitHub PAT, sk- → OpenAI, AKI → AWS) and exact lengths, reducing brute force attack space.

Changes

actions/setup/js/redact_secrets.cjs

• Replace variable-length prefix-preserving redaction with fixed-length ***REDACTED*** string
• Apply to both redactBuiltInPatterns (regex-based) and redactSecrets (exact-match) functions

actions/setup/js/redact_secrets.test.cjs

• Update all test expectations to match new redaction format

Example

Before (vulnerable):

"Token: ghp_1234567890ABCDEFGHIJKLMNOPQRSTUVWxyz"
// Redacted to:
"Token: ghp*************************************"  // ⚠️ Type revealed

After (secure):

"Token: ghp_1234567890ABCDEFGHIJKLMNOPQRSTUVWxyz"
// Redacted to:
"Token: ***REDACTED***"  // ✅ No information disclosed

Security Impact

• Token type identification: eliminated
• Length disclosure: eliminated
• Attack surface: no longer reduced by leaked metadata

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This pull request fixes a security vulnerability (CWE-200: Information Exposure) in the secret redaction system. Previously, redacted secrets preserved the first 3 characters of tokens, which leaked service identification (e.g., ghp_ for GitHub PATs, sk- for OpenAI keys) and exact token lengths, reducing the attack surface for brute force attempts. The fix replaces variable-length prefix-preserving redaction with a fixed-length ***REDACTED*** string.

Changes:

• Updated secret redaction functions to use fixed-length ***REDACTED*** replacement string
• Removed prefix preservation logic that exposed the first 3 characters of secrets
• Updated all test expectations to match the new secure redaction format

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
actions/setup/js/redact_secrets.cjs	Implemented fixed-length redaction in both redactBuiltInPatterns and redactSecrets functions, eliminating information disclosure
actions/setup/js/redact_secrets.test.cjs	Updated all test expectations from prefix-preserving format (e.g., ghp*****...) to fixed-length ***REDACTED*** format

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.