fix(security): redact AIza credentials of any length in error bodies

changelog.d/fixes/google-key-redaction-length.md

@@ -0,0 +1 @@
+- Redact Google API keys of any length in error bodies: the pattern required exactly 39 characters, so shorter or longer `AIza…` credentials passed through unredacted.

open-sse/utils/credentialPatterns.ts

@@ -18,7 +18,13 @@ export const CREDENTIAL_PATTERNS: CredentialPattern[] = [
     regex: /sk-ant-[A-Za-z0-9_-]{20,}/g,
     replacement: "[REDACTED:anthropic]",
   },
-  { name: "google", regex: /AIza[0-9A-Za-z_-]{35}/g, replacement: "[REDACTED:google]" },
+  // {20,} rather than the exact {35} of a standard 39-char Google API key. #12506 added
+  // this pattern with the exact length; #12620 landed the anti-drift test that asserts
+  // /\bAIza[A-Za-z0-9_-]{20,}/ must not survive. Anything shorter or longer than 39 was
+  // therefore passing straight through into error bodies. In an error message
+  // over-redacting a string that merely starts with AIza costs nothing; under-redacting
+  // one leaks a credential, so the loose bound is the correct side to err on.
+  { name: "google", regex: /AIza[0-9A-Za-z_-]{20,}/g, replacement: "[REDACTED:google]" },
   { name: "huggingface", regex: /hf_[A-Za-z0-9]{34}/g, replacement: "[REDACTED:hf]" },
   { name: "replicate", regex: /r8_[A-Za-z0-9]{37}/g, replacement: "[REDACTED:replicate]" },
   { name: "github", regex: /gh[pousr]_[A-Za-z0-9]{36,}/g, replacement: "[REDACTED:github]" },