AIKIDO-2026-10147

TL;DR

Affected versions of this package improperly masked Testomatio API tokens in logs, allowing sensitive values (e.g., tstmt_...) to be partially exposed due to insufficient pattern handling and type safety. An attacker could exploit this by accessing application logs (via log aggregation systems, support dumps, CI logs, or compromised observability tooling) to harvest valid API tokens and impersonate the service, perform unauthorized API actions, exfiltrate test data, or pivot to other systems that trust those credentials.