From 9392b3057546f8e2458d5ac09f12bcd404eabc36 Mon Sep 17 00:00:00 2001
From: Aman <1402357+Zartharas@users.noreply.github.com>
Date: Tue, 18 Aug 2026 07:51:34 -0600
Subject: [PATCH] fix(compliance): redact extra provider API keys (#10521)

---
 .../fixes/10521-audit-extra-api-keys-redaction.md    |  1 +
 src/lib/compliance/index.ts                          |  1 +
 tests/unit/compliance-index.test.ts                  | 12 ++++++++++++
 3 files changed, 14 insertions(+)
 create mode 100644 changelog.d/fixes/10521-audit-extra-api-keys-redaction.md

diff --git a/changelog.d/fixes/10521-audit-extra-api-keys-redaction.md b/changelog.d/fixes/10521-audit-extra-api-keys-redaction.md
new file mode 100644
index 0000000000..41222522de
--- /dev/null
+++ b/changelog.d/fixes/10521-audit-extra-api-keys-redaction.md
@@ -0,0 +1 @@
+- **fix(compliance):** redact additional provider API keys from audit-log payloads ([#10521](https://github.com/diegosouzapw/OmniRoute/pull/10521)) — thanks @Zartharas
diff --git a/src/lib/compliance/index.ts b/src/lib/compliance/index.ts
index e02ed83be8..d551261ef1 100644
--- a/src/lib/compliance/index.ts
+++ b/src/lib/compliance/index.ts
@@ -111,6 +111,7 @@ const AUDIT_LOG_REQUIRED_COLUMNS: Record<string, string> = {
 
 const SENSITIVE_AUDIT_KEYS = new Set([
   "apikey",
+  "extraapikeys",
   "accesstoken",
   "refreshtoken",
   "idtoken",
diff --git a/tests/unit/compliance-index.test.ts b/tests/unit/compliance-index.test.ts
index 8229148fd3..f99a5a4b26 100644
--- a/tests/unit/compliance-index.test.ts
+++ b/tests/unit/compliance-index.test.ts
@@ -92,6 +92,12 @@ test("compliance audit log supports structured filters, totals and secret redact
       nested: {
         refreshToken: "refresh-secret",
       },
+      providerSpecificData: {
+        extraApiKeys: ["sk-extra-1", "sk-extra-2"],
+        token: "token-secret",
+        userToken: "user-token-secret",
+        cookie: "cookie-secret",
+      },
       changedFields: ["defaultModel"],
     },
     ipAddress: "10.0.0.4",
@@ -133,6 +139,12 @@ test("compliance audit log supports structured filters, totals and secret redact
     nested: {
       refreshToken: "[redacted]",
     },
+    providerSpecificData: {
+      extraApiKeys: "[redacted]",
+      token: "[redacted]",
+      userToken: "[redacted]",
+      cookie: "[redacted]",
+    },
     changedFields: ["defaultModel"],
   });
   assert.deepEqual(updatedEntry.metadata, updatedEntry.details);