fix(security): credential redaction in 0f8b000 misses JSON bodies access_token, refresh_token, clientSecret, and password print verbatim with --verbose

[gyanranjanpanda]

Problem

i added credential redaction to verbose HTTP dumps. It works for Authorization headers but misses both places where secrets actually appear.

Leak 1 Keycloak token response (keycloak_client.go:96)

The response body is JSON. The regex expects name=value (form encoding), so "access_token":"eyJ..." prints verbatim.

Leak 2 create-test request body (microcks_client.go:371)

OAuth2ClientContext is marshalled into the POST body. Fields clientSecret, password, and refreshToken aren't in the pattern at all.

The header redaction fires correctly, which is exactly what makes this easy to miss:

Authorization: [REDACTED]       ← works
{"oAuth2Context":{"clientSecret":"SECRET","password":"SECRET",...}}   ← leaks

Root Cause

// only matches name=value — never fires on JSON bodies
var sensitiveParamPattern = regexp.MustCompile(
    `(?i)(access_token|refresh_token|id_token|code)=([^&\s]+)`,
)

Apply it alongside the existing patterns in redactSensitiveContent.

Reproduce

Drop into pkg/config/redact_probe_test.go and run go test ./pkg/config/ -run TestRedactProbe -v — 6 FAILs, all confirmed against the real function.

[gyanranjanpanda]

@Harsh4902 @Caesarsage could verify this issue

[Harsh4902]

Thanks @gyanranjanpanda, I think this is correct. As we are storing the credentials into the config file, we are exposing the AuthClientContext, and this can lead us to leaking credentials. Though I'll do the thorough check.