[harshitethic]

Summary

Ten focused, independently committed changes expand ClonePeek's best-effort evidence redaction and add a regression test for each case.

Changes

• Mask GitLab personal access tokens, npm auth tokens, PyPI upload tokens, Slack workspace tokens, Stripe secret keys, Google API keys, and temporary AWS access-key identifiers.
• Mask Authorization: Bot ... values.
• Mask user/password pairs in SSH, SOCKS, FTP and HTTP(S) URL authority sections while preserving their schemes.
• Neutralize ANSI color sequences, terminal title sequences, C0/C1 control characters, and bidirectional text controls before applying token matching, mitigating log spoofing and simple formatting-based detection bypass.

Verification

• Linux / Python 3.12: PYTHONPATH=src python3 -m unittest discover -s tests -q → 92/92 tests passed (82 baseline + 10 new regression methods).
• Focused redaction tests: 14/14 passed.
• python3 -m compileall -q src tests → passed.
• git diff main..HEAD --check → passed.
• Separate Linux and macOS source trees yielded identical diffs (SHA-256 241bc0a706666d90806e81a3c926a99a1dca033f7454d4b70befbc9e33ae7c4a).
• All regression fixtures use synthetic values, not real credentials. No untrusted hooks, scripts, or project dependencies executed.

Scope and limitations

The masking remains best-effort, not a credential discovery guarantee or comprehensive security audit. The newly recognized patterns intentionally redact some additional text in reports; reviewers should check for unacceptable false positives. macOS default Python 3.9 is below ClonePeek's supported Python >=3.10 and was used only to reproduce commits, not as test evidence.