From aac1129761cecce08611cfeb0f6455d9d5b221b0 Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Tue, 30 Sep 2025 17:05:57 -0700 Subject: [PATCH] fix is_sensitive_key --- litellm/litellm_core_utils/sensitive_data_masker.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/litellm/litellm_core_utils/sensitive_data_masker.py b/litellm/litellm_core_utils/sensitive_data_masker.py index 985f17e92fd..05f1a37ca12 100644 --- a/litellm/litellm_core_utils/sensitive_data_masker.py +++ b/litellm/litellm_core_utils/sensitive_data_masker.py @@ -44,7 +44,14 @@ class SensitiveDataMasker: def is_sensitive_key(self, key: str) -> bool: key_lower = str(key).lower() - result = any(pattern in key_lower for pattern in self.sensitive_patterns) + # Split on underscores and check if any segment matches the pattern + # This avoids false positives like "max_tokens" matching "token" + # but still catches "api_key", "access_token", etc. + key_segments = key_lower.replace('-', '_').split('_') + result = any( + pattern in key_segments + for pattern in self.sensitive_patterns + ) return result def mask_dict(