diff --git a/litellm/_logging.py b/litellm/_logging.py index 5023c9e952a..9f301aa6ca8 100644 --- a/litellm/_logging.py +++ b/litellm/_logging.py @@ -31,15 +31,32 @@ _REDACTED = "REDACTED" def _build_secret_patterns() -> re.Pattern: patterns: List[str] = [ + # AWS access key IDs r"(?:AKIA|ASIA)[0-9A-Z]{16}", + # AWS secrets / session tokens / access key IDs (key=value) r"(?:aws_secret_access_key|aws_session_token|aws_access_key_id)" - r"(?:\s*[:=]\s*)([A-Za-z0-9/+=]{20,})", + r"\s*[:=]\s*[A-Za-z0-9/+=]{20,}", + # Bearer tokens (OAuth, JWT, etc.) r"Bearer\s+[A-Za-z0-9\-._~+/]{10,}=*", + # Basic auth headers + r"Basic\s+[A-Za-z0-9+/]{10,}={0,2}", + # OpenAI / Anthropic sk- prefixed keys r"sk-[A-Za-z0-9\-_]{20,}", - r"(?:api[_-]?key\s*[:=]\s*)([0-9a-fA-F]{32})", - r"(?:x-api-key|api-key)\s*[:=]\s*\S+", + # Generic api_key / api-key / apikey (handles 'key': 'value' dict repr) + r"(?:api[_-]?key)['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]{8,}", + # x-api-key / api-key header values (handles 'key': 'value' dict repr) + r"(?:x-api-key|api-key)['\"]?\s*[:=]\s*['\"]?\S+", + # Anthropic internal header keys r"x-ak-[A-Za-z0-9\-_]{20,}", + # Google API keys r"AIza[0-9A-Za-z\-_]{35}", + # Password / secret params (handles key=value and 'key': 'value') + r"\w*(?:password|passwd|client_secret|secret_key|_secret)" + r"['\"]?\s*[:=]\s*['\"]?[^\s,'\"})\]{}>]+", + # Database connection string credentials (scheme://user:pass@host) + r"(?<=://)[^\s'\"]*:[^\s'\"@]+(?=@)", + # Databricks personal access tokens + r"dapi[0-9a-f]{32}", ] return re.compile("|".join(patterns), re.IGNORECASE)