From e7b3dbfb0fb7957337418cc25df3a3349953aff8 Mon Sep 17 00:00:00 2001
From: Mustansir <mustansir2001@gmail.com>
Date: Thu, 13 Nov 2025 16:15:35 +0500
Subject: [PATCH] redact secret for twilio api key (#4550)

---
 pkg/detectors/twilioapikey/twilioapikey.go    |  2 +-
 .../twilioapikey/twilioapikey_test.go         | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/pkg/detectors/twilioapikey/twilioapikey.go b/pkg/detectors/twilioapikey/twilioapikey.go
index 4a73e11d7..677e4ceb3 100644
--- a/pkg/detectors/twilioapikey/twilioapikey.go
+++ b/pkg/detectors/twilioapikey/twilioapikey.go
@@ -63,7 +63,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				DetectorType: detectorspb.DetectorType_Twilio,
 				Raw:          []byte(apiKey),
 				RawV2:        []byte(apiKey + secret),
-				Redacted:     secret,
+				Redacted:     secret[:5] + "...",
 				ExtraData:    make(map[string]string),
 			}
 
diff --git a/pkg/detectors/twilioapikey/twilioapikey_test.go b/pkg/detectors/twilioapikey/twilioapikey_test.go
index 0af8521ea..4e61f3462 100644
--- a/pkg/detectors/twilioapikey/twilioapikey_test.go
+++ b/pkg/detectors/twilioapikey/twilioapikey_test.go
@@ -81,3 +81,24 @@ func TestTwilioAPIKey_Pattern(t *testing.T) {
 		})
 	}
 }
+
+func TestTwilioAPIKey_SecretRedacted(t *testing.T) {
+	d := Scanner{}
+
+	results, err := d.FromData(
+		context.Background(),
+		false,
+		[]byte(fmt.Sprintf("%s token - '%s'\n%s token - '%s'\n", keyword, validAPIKey, keyword, validSecret)))
+	if err != nil {
+		t.Errorf("error = %v", err)
+		return
+	}
+
+	if len(results) == 0 {
+		t.Errorf("did not receive result")
+	}
+
+	if results[0].Redacted != validSecret[:5]+"..." {
+		t.Errorf("expected redacted secret to be '%s', got '%s'", validSecret[:5]+"...", results[0].Redacted)
+	}
+}