[Kielek]

This fix addresses a ANT-2026-CKH8AP2O finding from Anthropic's OSS Scanner.
Project enrollment: anthropics/oss-scanner#117.

Changes

Self-diagnostics could write a folded PEM value in a certificate-path environment
variable into the default log preamble when literal quotes preceded its armour.
Recognizable PEM material is now redacted wherever it occurs, including
whole-PEM base64 encoding, and quoted or prefixed JWTs are detected at token
boundaries.

Adds 17 regression cases for all three certificate variables, the real preamble,
resource attributes, ordinary certificate paths, and the existing disclosure
modes. Recognizable inline material redacts the whole setting, including resource
attributes. Explicit AllValues output remains available. No public API changes.

Merge requirement checklist

• CONTRIBUTING guidelines followed (license requirements, successful build/tests, etc.; changelog link pending)
• Tests added/updated
• CHANGELOG.md file(s) updated for non-trivial changes
• [ ] Changes in public API reviewed (if applicable; no public API changes)
• AI usage disclosure:
  • No AI used
  • AI-assisted
  • Bulk AI-generated
• I have the experience and knowledge necessary to understand, review, and validate all content in this PR¹

Footnotes

1. Yes, I can answer maintainer questions about the content of this PR without using AI. ↩

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-10-16 11:22 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.30%. Comparing base (737e973) to head (2e0af33).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7955      +/-   ##
==========================================
- Coverage   92.30%   92.30%   -0.01%     
==========================================
  Files         363      363              
  Lines       21035    21044       +9     
==========================================
+ Hits        19416    19424       +8     
- Misses       1619     1620       +1     

Flag	Coverage Δ
unittests-Project-Experimental	92.43% <100.00%> (-0.01%)	⬇️
unittests-Project-Stable	92.43% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ostics/SelfDiagnosticsEnvironmentVariablePolicy.cs	99.07% <100.00%> (+0.03%)	⬆️

... and 1 file with indirect coverage changes