From 38cd720f764640c56747b9d7c9d551e827567559 Mon Sep 17 00:00:00 2001
From: Shintomon Mathew <148446196+MysticShinM@users.noreply.github.com>
Date: Mon, 18 May 2026 19:32:45 +0530
Subject: [PATCH] creds: mask OAuth bearer token in trace logs

Masked OAuth bearer tokens in credential trace output by emitting ***
when a bearer token is present, matching the existing password redaction
behavior and preventing sensitive token disclosure in verbose/debug
logs.

Closes #21659
---
 lib/creds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/creds.c b/lib/creds.c
index 8303891967..e59c601b95 100644
--- a/lib/creds.c
+++ b/lib/creds.c
@@ -181,7 +181,7 @@ void Curl_creds_trace(struct Curl_easy *data, struct Curl_creds *creds,
                Curl_creds_user(creds),
                Curl_creds_has_passwd(creds) ? "***" : "",
                Curl_creds_sasl_authzid(creds),
-               Curl_creds_oauth_bearer(creds),
+               Curl_creds_has_oauth_bearer(creds) ? "***" : "",
                creds->source);
   }
   else