From d6b0c4d65f5337d0819c6f7634a0acceb03e7ea7 Mon Sep 17 00:00:00 2001
From: deepfates <deepfates@gmail.com>
Date: Mon, 28 Sep 2026 06:56:44 -0700
Subject: [PATCH] Redaction: an sk- key right after a hyphen

---
 lib/imp/redaction.ex                 | 5 +++--
 test/redaction_differential_test.exs | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/imp/redaction.ex b/lib/imp/redaction.ex
index cc7d664e..ae0a01d9 100644
--- a/lib/imp/redaction.ex
+++ b/lib/imp/redaction.ex
@@ -917,8 +917,9 @@ defmodule Imp.Redaction do
       # encrypted), a PGP private key block, a PuTTY key file.
       ~r/-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----/,
       ~r/PuTTY-User-Key-File-[0-9]+:/,
-      # OpenAI (`sk-`, `sk-proj-`), Anthropic (`sk-ant-`), OpenRouter (`sk-or-`).
-      ~r/(?:\A|[^A-Za-z0-9_-])sk-[A-Za-z0-9_-]{8,}(?=\z|[^A-Za-z0-9_-])/,
+      # OpenAI (`sk-`, `sk-proj-`), Anthropic (`sk-ant-`), OpenRouter (`sk-or-`),
+      # also right after a hyphen (`x-sk-...`), as a word boundary allows.
+      ~r/(?:\A|[^A-Za-z0-9_])sk-[A-Za-z0-9_-]{8,}(?=\z|[^A-Za-z0-9_-])/,
       # Stripe secret and restricted live keys.
       ~r/(?<![A-Za-z0-9_])[sr]k_live_[A-Za-z0-9]{16,}(?![A-Za-z0-9_])/,
       # GitHub classic, OAuth, user-to-server, server and refresh tokens, and
diff --git a/test/redaction_differential_test.exs b/test/redaction_differential_test.exs
index 70bd185e..b63b6013 100644
--- a/test/redaction_differential_test.exs
+++ b/test/redaction_differential_test.exs
@@ -321,6 +321,7 @@ defmodule Imp.RedactionDifferentialTest do
     sk = "sk-FAKEopenai" <> String.duplicate("a1", 12)
 
     [
+      {"key after a hyphen", "flag x-#{sk} set\n"},
       {"printenv",
        "HOME=/root\nOPENAI_API_KEY=#{sk}\nSECRET_KEY_BASE=FAKEskbQQQQQQQQQQQQ\nPGPASSWORD=FAKEpgpass99\nRELEASE_COOKIE=FAKEcookie\nSTRIPE_KEY=FAKEstripeplain\n"},
       {"curl -v",