diff --git a/litellm/_logging.py b/litellm/_logging.py index 7878a5aa752..45f864072b1 100644 --- a/litellm/_logging.py +++ b/litellm/_logging.py @@ -469,13 +469,9 @@ class CredentialScrubberFilter(logging.Filter): if isinstance(record.args, dict): record.args = { k: ( - ( - _REDACTED - if _SECRET_KEY_NAME_RE.match(k) - else _scrub_secrets(str(v)) - ) - if isinstance(v, str) - else v + _REDACTED + if _SECRET_KEY_NAME_RE.match(k) + else (_scrub_secrets(str(v)) if isinstance(v, str) else v) ) for k, v in record.args.items() } diff --git a/tests/test_litellm/test_credential_scrubber.py b/tests/test_litellm/test_credential_scrubber.py index b789d6237ce..8cd2fb13001 100644 --- a/tests/test_litellm/test_credential_scrubber.py +++ b/tests/test_litellm/test_credential_scrubber.py @@ -201,3 +201,14 @@ class TestCredentialScrubberFilter: f.filter(record) assert "sk-rawsecretvalue123" not in str(record.args) assert "[REDACTED]" in str(record.args) + + def test_dict_args_secret_key_non_string_value_redacted(self): + # Branch: dict key is a secret name but value is not a str (e.g. bytes). + # Key-name check must fire regardless of value type. + from litellm._logging import CredentialScrubberFilter + + f = CredentialScrubberFilter() + record = self._make_record("config %s", {"api_key": b"sk-bytessecret123"}) + f.filter(record) + assert "sk-bytessecret123" not in str(record.args) + assert "[REDACTED]" in str(record.args)