securenow 8.11.1 → 8.11.3

package/NPM_README.md

@@ -1307,7 +1307,7 @@ all runtime settings from this JSON plus built-in defaults. Production should
 mount a tokenless runtime credentials file at `.securenow/credentials.json`.
 Environment-variable fallback is not supported.
 
-**Default sensitive fields (auto-redacted):** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`
+**Default sensitive fields (auto-redacted):** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`, `code`, `otpCode`, `oneTimeCode`, `verificationCode`, `passcode`
 
 For instrumentation, firewall layers, debugging, trusted proxies, and deployment
 environment, edit the matching `config.*` keys in `.securenow/runtime.json`
@@ -1450,6 +1450,8 @@ File binary content is never stored in traces.
 
 ### Sensitive Data Redaction
 
+SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
+
 All request bodies are automatically scanned and sensitive fields are redacted:
 
 **Automatically redacted fields:** `password`, `secret`, `token`, `api_key`, `card`, `cvv`, `ssn`, and more.

package/README.md

@@ -228,6 +228,8 @@ It syncs your app's blocklist plus SecureNow's IP database of 500k+ known-bad IP
 
 - **SecureNow never needs your source code.** It sees runtime telemetry — requests, spans, logs — not your repository.
 - **Redacted at capture.** `password`, `token`, `api_key`, `authorization`, `cookie`, and friends are auto-redacted before leaving your process; multipart file content is never captured. Preview with `securenow redact '<json>'`.
+
+  SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
 - **Fails open.** If SecureNow is unreachable, your app serves traffic normally (`config.firewall.failMode: "open"` is the default).
 - **Read/write split.** MCP read tools are read-only; write tools require explicit `confirm: true` plus a reason, and human approval is the designed path for mutations — blocks, rate limits, and revocations are proposed, approved, executed, and reversible.
 

package/SKILL-API.md

@@ -542,6 +542,8 @@ securenow cidr parse 10.0.0.0/8                             # network/broadcast/
 
 ## Sensitive Data Redaction
 
+SecureNow 8.11.2 redacts sign-in credentials named `code`, `otpCode`, `oneTimeCode`, `verificationCode`, and `passcode` by default, including case and separator variants. JSON, form, GraphQL, and multipart text capture use the same rule; URL query parameters and captured headers are also protected. Credential names match exactly after normalization, so `status_code` and `error_code` remain available for investigation. Redaction changes exported telemetry only.
+
 Available from multiple entry points (`securenow/nextjs-middleware`, `securenow/nextjs-wrapper`, `securenow/nextjs-auto-capture`):
 
 ```javascript
@@ -551,7 +553,7 @@ const safe = redactSensitiveData({ username: 'alice', password: 's3cret', token:
 // { username: 'alice', password: '[REDACTED]', token: '[REDACTED]' }
 ```
 
-**Auto-redacted fields:** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`.
+**Auto-redacted fields:** `password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `apikey`, `access_token`, `auth`, `credentials`, `mysql_pwd`, `stripeToken`, `card`, `cardnumber`, `ccv`, `cvc`, `cvv`, `ssn`, `pin`, `code`, `otpCode`, `oneTimeCode`, `verificationCode`, `passcode`.
 
 Add custom fields via `config.capture.sensitiveFields` in `.securenow/runtime.json`.