A version pin is not a credential

[christophergeyer]

The bug

The env-var redaction rule matched any name containing key|token|secret|password|passwd|pwd|credential|auth, case-insensitively, followed by =.

A pip requirement satisfies that. tiktoken==0.12.0 is a name ending in token followed by =, so the version was redacted as though it were a credential:

'tiktoken==[REDACTED]'

No installer can execute that, so the recorded environment cannot be rebuilt — the one thing a freeze exists to make possible.

It cost a completed 3.5-hour training run its reproducibility gate. The model trained, the lineage published, the AI-BOM scored 100/100, every public URL resolved — and the row still could not claim tier 1, because one dependency version in the generated install command was the string [REDACTED].

Not specific to tiktoken. All of these contain a keyword and are ordinary dependencies:

tiktoken  authlib  keyring  tokenizers  python-jose  secretstorage

The fix

Case-sensitive, and a single = only:

r"([A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|AUTH)[A-Z_]*)"
r"(?<!=)=(?!=)([^\s]+)"

Both restrictions are load-bearing:

• Case-sensitivity. Environment variables are uppercase by convention and POSIX reserves that space for them. HF_TOKEN=, OPENAI_API_KEY= and MYTOKEN= are still redacted; every lowercase package name is spared.
• A single =. Spares version pins whatever their case, so an uppercase package name would not trip it either.

What this gives up

A lowercase-named variable holding a secret with no recognisable prefix — hf_token=... where the value is not hf_.... That is unconventional, and the value-shaped rules (hf_, sk-, ghp_, glpat-, AKIA) catch the real providers by token format rather than by variable name. There is a test asserting exactly that.

Verification

• 14 tests, both directions: six real dependencies survive; a generated pip install line survives intact; five environment assignments are still redacted, including inside a longer command where --depth=14 must also survive.
• Negative control: restoring the old rule fails six of them.
• tests/unit/test_register_secrets.py and test_omit_filter_git_urls.py still green.
• Full unit suite: 1,227 passed.