fix(client): redact credentials from TF_LOG=DEBUG dumps

[tembleking]

DumpRequestOut/DumpResponse with body=true logged raw HTTP request/response bytes at DEBUG level, including the Authorization bearer token and any secret-bearing JSON/form field (IBM's access_token, apikey, accessKey, apiKey, clientSecret, routingKey, serviceKey, publicToken...). Anyone running with TF_LOG=DEBUG leaked live credentials into their logs.

Redact by pattern instead of hardcoding field names: any header, JSON field, or form value whose name looks like a credential (auth/key/token/secret/password/credential) gets scrubbed, escape-aware so an escaped quote inside a secret can't leak the rest of the string. Also strip the provider's own configured secrets (token, IBM apikey, extra_headers values) as a literal-value fallback for anything the name-based patterns miss.

[Copilot]

🟡 Changes recommended

The JSON and form-field redaction patterns currently omit the “auth” keyword described in the PR, which can still allow certain credential fields (e.g., auth/authorization) to leak in debug dumps.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the Sysdig provider’s internal HTTP client debug logging by redacting credentials from httputil.DumpRequestOut / httputil.DumpResponse output, reducing the risk of leaking live secrets when users run with TF_LOG=DEBUG.

Changes:

• Added regex-based redaction for credential-like headers, JSON fields, and form/query parameters in request/response dumps.
• Added a “known secrets” literal-value fallback (provider-configured token, IBM API key, and extra_headers values) to scrub secrets even when key names are unexpected.
• Added unit tests covering several credential formats and escaping behavior.

File summaries

File	Description
sysdig/internal/client/v2/client.go	Introduces dump redaction helpers and applies them to DEBUG request/response logging.
sysdig/internal/client/v2/client_test.go	Adds unit tests validating redaction behavior across headers/JSON/form payloads.

Review details

Suppressed comments (1)

sysdig/internal/client/v2/client.go:55

• The form/query-string redaction regex also omits the "auth" keyword mentioned in the PR description. This can miss fields like "auth" or "authorization" in x-www-form-urlencoded bodies or URLs and leak credentials in debug dumps.

// sensitiveFormFieldRe redacts the value of any x-www-form-urlencoded (or
// URL query string) field whose name looks like it carries a credential,
// e.g. IBM IAM's "apikey=..." token-exchange request body.
var sensitiveFormFieldRe = regexp.MustCompile(`(?i)(\w*(?:key|token|secret|password|credential)\w*=)[^&\s"]*`)

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.