Stop the ak-/as- key pattern matching kebab-case English

[aviggiano]

Closes #822.

Change

- /\b(?:ak|as)-[A-Za-z0-9_-]{16,}\b/gu,
+ /\b(?:ak|as)-[A-Za-z0-9_]{16,}\b/gu,

One character. The suffix class permitted -, so the pattern matched any hyphenated prose containing the fragment as- or ak- followed by 16+ characters.

Why it matters more than it looks

This is a vendor pattern, not one of the speculative heuristics from #819, so it fires even under a "positive-only" publication scan. And the failure it causes is quiet.

In a real campaign it killed verify:goal-plan. That node is continueOnFail, so the run did not stop — it carried on and kept reporting healthy node counts. But two dynamic groups are sourced from that verifier:

class-goals  <- verify:goal-plan
threat-goals <- verify:goal-plan

Neither can expand once it has failed. The goal-directed portion of the audit was silently skipped while the run continued toward a "successful" finish. Nothing in the progress output indicates the loss.

Verification

Prose that must publish (all three fail on main, all clean after):

• policy.record-treated-as-private-to-the-service
• classified-as-internal-only-configuration-value
• resources-marked-ak-restricted-to-the-owner-role

Opaque tokens that must stay detected (all still detected):

• ak-AbCdEf1234567890XyZwVuTs
• as-9f2b7c1d4e6a8b0c3d5e7f90
• ak-AbCdEf_1234567890_XyZwVu — underscores still allowed

The existing modal ak-… / modal as-… fixtures are unaffected, since neither contains a hyphen in the suffix. A regression test covers both directions.

snake_case prose (treated_as_private_to_the_protocol_value) never matched and still doesn't — _ is a word character, so the leading \b cannot fire. Only the hyphenated form was affected.

19/19 security tests; lint and format:check clean.

Note on the artifacts suite

a runtime document read rejects an atomic path replacement during its snapshot fails on this branch, as it does on main — it is a pre-existing ~50% flaky test, unrelated to this change. #820 fixes it (it turns out to be a real TOCTOU gap, not a slow test). Independent of this PR.

Greptile Summary

This PR narrows the Modal-style ak-/as- credential pattern so kebab-case prose no longer triggers secret detection while documented opaque token forms remain protected.

• Removes hyphens from the credential suffix character class.
• Adds regression coverage for false-positive prose, redaction behavior, and supported tokens containing alphanumerics or underscores.

Confidence Score: 5/5

The PR appears safe to merge, with focused tests covering both the corrected false-positive behavior and retained credential detection.

The narrower character class matches the established ak-/as- token forms while preventing long hyphenated prose from being rejected as secret-bearing output, and no supported credential form was found to regress.

Important Files Changed

Filename	Overview
packages/security/src/sensitive-redaction.ts	Narrows the ak-/as- suffix pattern to avoid matching kebab-case prose without excluding any established valid credential format.
packages/security/test/sensitive-redaction.test.ts	Adds focused bidirectional regression tests for prose false positives and supported opaque credential forms.

_{Reviews (1): Last reviewed commit: "fix(security): stop the ak-/as- key patt..." | Re-trigger Greptile}

[aviggiano]

This sensitive redaction is giving us too much headache, we want preferably to use a 3rd party library instead of reinventing the wheel

[aviggiano]

Superseded by #865: the ak-/as- vendor pattern (including this PR's no-hyphen suffix fix) now lives as a documented supplemental pattern alongside secretlint 13.0.4, with the kebab-case-prose regression ported as a test.