From 5f3d16577664e8808d13ecb2a3e1f2585a721fdc Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Sat, 7 Nov 2026 11:00:10 -0500
Subject: [PATCH] Generate the redaction test values with crypto/rand

TestRedactLiterals wrote 'supersecretvalue' down, and the token-shape
cases were a prefix plus a run of one repeated letter, which GitGuardian
still matched and reported. Every value is now drawn from crypto/rand in
the alphabet its pattern expects, so the cases also cover more than one
fixed string.
---
 internal/secret/redact_test.go | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/internal/secret/redact_test.go b/internal/secret/redact_test.go
index 1c9ea39..461db27 100644
--- a/internal/secret/redact_test.go
+++ b/internal/secret/redact_test.go
@@ -1,14 +1,34 @@
 package secret
 
 import (
-	"strings"
+	"crypto/rand"
 	"testing"
 )
 
+// gen returns n characters drawn from alphabet with crypto/rand, so no test
+// value is written down and a secret scanner has nothing to match.
+func gen(t *testing.T, n int, alphabet string) string {
+	t.Helper()
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		t.Fatal(err)
+	}
+	for i := range b {
+		b[i] = alphabet[int(b[i])%len(alphabet)]
+	}
+	return string(b)
+}
+
+const (
+	lowerDigits = "abcdefghijklmnopqrstuvwxyz0123456789"
+	upperDigits = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
+)
+
 func TestRedactLiterals(t *testing.T) {
 	r := New()
-	r.Add("supersecretvalue", "abc") // "abc" too short -> ignored
-	got := r.Redact("token=supersecretvalue rest")
+	secret := gen(t, 16, lowerDigits)
+	r.Add(secret, "abc") // "abc" too short -> ignored
+	got := r.Redact("token=" + secret + " rest")
 	if got != "token="+Mask+" rest" {
 		t.Fatalf("literal not redacted: %q", got)
 	}
@@ -21,10 +41,10 @@ func TestRedactTokenShapes(t *testing.T) {
 	// Token-shaped values are assembled at run time so the source carries no
 	// literal a secret scanner matches by prefix.
 	cases := []string{
-		"ghp_" + strings.Repeat("x", 36),
-		"glpat-" + strings.Repeat("x", 20),
-		"AKIA" + strings.Repeat("X", 16),
-		"Bearer abcdefghijklmnopqrstuvwxyz",
+		"ghp_" + gen(t, 36, lowerDigits),
+		"glpat-" + gen(t, 20, lowerDigits),
+		"AKIA" + gen(t, 16, upperDigits),
+		"Bearer " + gen(t, 26, lowerDigits),
 	}
 	r := New()
 	for _, c := range cases {