From 88cde20b97563037df8242dac5e802e57079db95 Mon Sep 17 00:00:00 2001
From: ExoHayvan <18trevor3695@gmail.com>
Date: Wed, 22 Jul 2026 21:58:13 -0400
Subject: [PATCH] Potential fix for code scanning alert no. 4: Polynomial
 regular expression used on uncontrolled data

---
 src/aethermesh_core/local_audit_event.py | 2 +-
 tests/test_local_audit_event.py          | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/aethermesh_core/local_audit_event.py b/src/aethermesh_core/local_audit_event.py
index 9902d77..ae38647 100644
--- a/src/aethermesh_core/local_audit_event.py
+++ b/src/aethermesh_core/local_audit_event.py
@@ -54,7 +54,7 @@
     r"""(?ix)
     \b(?:bearer|basic)\s+[a-z0-9._~+/:=-]+
     |
-    [\"']?(?:[a-z0-9]+[_-])?(?:api[_-]?key|private[_-]?key|password|secret|token|seed(?:[_ -]?phrase)?|credential|authorization)[\"']?\s*[:=]\s*(?:\"[^\"\r\n]*\"|'[^'\r\n]*'|[^,;\r\n]+)
+    [\"']?(?:[a-z0-9]+[_-])?(?:api[_-]?key|private[_-]?key|password|secret|token|seed(?:[_ -]?phrase)?|credential|authorization)[\"']?\s*+[:=]\s*+(?:\"[^\"\r\n]*\"|'[^'\r\n]*'|[^,;\r\n]+)
     """
 )
 AUDIT_EVENT_TYPES = frozenset(
diff --git a/tests/test_local_audit_event.py b/tests/test_local_audit_event.py
index 56ef353..fbb8da6 100644
--- a/tests/test_local_audit_event.py
+++ b/tests/test_local_audit_event.py
@@ -6,6 +6,7 @@
 from aethermesh_core.local_audit_event import (
     AUDIT_EVENT_TYPES,
     AUDIT_REDACTED_VALUE,
+    _SECRET_IN_TEXT,
     LocalAuditEventError,
     append_local_audit_event,
     sanitize_local_audit_event,
@@ -14,6 +15,9 @@
 
 
 class LocalAuditEventTests(unittest.TestCase):
+    def test_secret_redaction_prevents_separator_whitespace_backtracking(self) -> None:
+        self.assertEqual(_SECRET_IN_TEXT.pattern.count(r"\s*+"), 2)
+
     def test_sanitizes_secret_values_in_unstructured_audit_context(self) -> None:
         secrets = {
             "api_key": "api-live-" + "9Fj2qL",