fix(redaction): anchor workflow token allowlist

Author: Bill Leoutsakos

apps/sim/lib/core/security/redaction.test.ts

@@ -111,6 +111,11 @@ describe('isSensitiveKey', () => {
     it.concurrent('should match ssh passphrases', () => {
       expect(isSensitiveKey('passphrase')).toBe(true)
     })
+
+    it.concurrent('should not allow arbitrary keys ending in workflow token names', () => {
+      expect(isSensitiveKey('asyncToken')).toBe(true)
+      expect(isSensitiveKey('homepageToken')).toBe(true)
+    })
   })
 
   describe('non-sensitive keys (no false positives)', () => {

apps/sim/lib/core/security/redaction.ts

@@ -15,7 +15,7 @@ export const TRUNCATED_MARKER = '[TRUNCATED]'
  * idempotency keys stay visible so users can pass them into subsequent steps.
  */
 const NON_SENSITIVE_TOKEN_KEY_PATTERNS: RegExp[] = [
-  /(?:page|pagination|continuation|cursor|scroll|sync)[_-]?token$/i,
+  /^(?:[A-Za-z0-9_-]+\.)*(?:(?:next|previous|after|before)[_-]?)?(?:page|pagination|continuation|cursor|scroll|sync)[_-]?token$/i,
   /^(?:next|previous|after|before)[_-]?token$/i,
   /^(?:client[_-]?request|idempotency)[_-]?token$/i,
   /^subjectFromWebIdentityToken$/i,