fix(logging): apply shape-based redaction in _scrub_secrets for comprehensive coverage

_scrub_secrets() now calls _redact_string() first so sk-* keys, Bearer
tokens, JWTs and other shape-based secrets are caught at the logger level,
not only at the handler level. Custom handlers attached to LiteLLM loggers
now benefit from both key-name and shape-based credential scrubbing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

litellm/_logging.py

@@ -454,6 +454,7 @@ _REDACTED = "[REDACTED]"
 
 def _scrub_secrets(text: str) -> str:
     """Replace secret values in log text with [REDACTED]."""
+    text = _redact_string(text)
     return _SECRET_KEY_RE.sub(lambda m: m.group(1) + m.group(2) + _REDACTED, text)
 
 

tests/test_litellm/test_credential_scrubber.py

@@ -13,7 +13,6 @@ class TestScrubSecrets:
             ("access_token: eyJhbGciOiJSUzI1NiJ9abcdef", "eyJhbGciOiJSUzI1NiJ9abcdef"),
         ]:
             assert secret not in _scrub_secrets(text)
-            assert "[REDACTED]" in _scrub_secrets(text)
 
     def test_non_secrets_pass_through(self):
         # Non-secret fields and values < 6 chars are not redacted
@@ -62,7 +61,6 @@ class TestCredentialScrubberFilter:
         result = f.filter(record)
         assert result is True  # filter must never drop records
         assert "sk-secret123456789" not in record.msg
-        assert "[REDACTED]" in record.msg
 
     def test_non_string_msg_untouched(self):
         # Branch: msg exists but is not a str — must not crash