AIKIDO-2025-10503

TL;DR

Affected versions of the package may inadvertently log sensitive information in verbose logs. Specifically, secret fields such as token, access_token, id_token, and password—when present in the response body but not explicitly marked as secret in the input schema—could be exposed in log output. The fixed version addresses this by automatically masking these fields in verbose logs, even if they are not defined as secret in the schema, reducing the risk of credential leakage or accidental exposure of sensitive data.