AIKIDO-2026-158758

TL;DR

The DataMasking.erase helper in the data masking utility catches invalid masking expressions and provider errors and returns the original field value instead of failing. An invalid regular expression in the masking configuration or an exception raised by a custom provider's erase implementation triggers this path silently. Applications that treat the result as masked can then write the unmasked sensitive field to a downstream destination such as CloudWatch Logs or S3. The patch raises DataMaskingError on these failures instead of returning the original value.