AIKIDO-2026-925299

TL;DR

Auth::Sanitizer::FilteredAttributes#inspect redacts sensitive values so host objects can be printed to logs, exceptions, and consoles safely. Before the fix, the method rebuilt inspect output and only redacted configured names when they were top-level instance variables, so configured names stored inside hash-valued instance variables (for example an adapter model holding attributes in an internal hash) were printed in cleartext. This exposes secrets such as tokens and password digests in standard Ruby hash inspect fragments, including nested hashes. The fix delegates to super.inspect and applies constrained pattern redaction that also covers configured names appearing as symbol or string hash keys.