bug(core): redactSecrets misses a sensitive assignment inside a harmless assignment's value #5433

What happened

redactSecrets does not redact a sensitive key=value or key: value assignment when it appears inside the value of a key that is not sensitive. Config excerpt: password=FAKE-not-a-real-password-000 comes back unchanged. password=FAKE-not-a-real-password-000 on its own is redacted.

ASSIGNED_SECRET_KEY_VALUE_PATTERN (packages/core/src/redaction.ts:45-46) matches the outer assignment excerpt: password=FAKE.... Its value runs until whitespace, a quote, &, < or >. The replace callback (:91-93) returns that match unchanged because excerpt is not sensitive. By then the global replace has already consumed the value, so the inner password= is never tested.

How to reproduce

import { redactSecrets } from '@maka/core/redaction';

redactSecrets('Config excerpt: password=FAKE-not-a-real-password-000');
// returns the input unchanged; expected 'Config excerpt: password=[redacted]'

The same happens with note: token=FAKE, summary=api_key: FAKE, user=alice;password=FAKE and flags: --password=FAKE (all fake values). JSON string values are affected too, because they go through the same text path.

Environment

• Maka commit: 672d827 (main)
• Surface: shared by Runtime and Runtime Host (@maka/core)
• Node.js: 22.23.1, running from source

Logs, screenshots, or additional context

SECURITY.md §2.4 treats redactSecrets() as a best-effort heuristic, not a boundary, so this is filed as a regular bug. The streaming display redactor in packages/core/src/display-redaction.ts is a separate module and is not affected.