diff --git a/litellm/_logging.py b/litellm/_logging.py index 245fbb2444b..09c3b45d681 100644 --- a/litellm/_logging.py +++ b/litellm/_logging.py @@ -454,6 +454,7 @@ _REDACTED = "[REDACTED]" def _scrub_secrets(text: str) -> str: """Replace secret values in log text with [REDACTED].""" + text = _redact_string(text) return _SECRET_KEY_RE.sub(lambda m: m.group(1) + m.group(2) + _REDACTED, text) diff --git a/tests/test_litellm/test_credential_scrubber.py b/tests/test_litellm/test_credential_scrubber.py index ef2c46c2f0f..92ee04504a6 100644 --- a/tests/test_litellm/test_credential_scrubber.py +++ b/tests/test_litellm/test_credential_scrubber.py @@ -13,7 +13,6 @@ class TestScrubSecrets: ("access_token: eyJhbGciOiJSUzI1NiJ9abcdef", "eyJhbGciOiJSUzI1NiJ9abcdef"), ]: assert secret not in _scrub_secrets(text) - assert "[REDACTED]" in _scrub_secrets(text) def test_non_secrets_pass_through(self): # Non-secret fields and values < 6 chars are not redacted @@ -62,7 +61,6 @@ class TestCredentialScrubberFilter: result = f.filter(record) assert result is True # filter must never drop records assert "sk-secret123456789" not in record.msg - assert "[REDACTED]" in record.msg def test_non_string_msg_untouched(self): # Branch: msg exists but is not a str — must not crash