From 5fc48f5e22b2ee411a0269b4e6ce59d667323527 Mon Sep 17 00:00:00 2001
From: Bhautik <bhautikrchudasama@gmail.com>
Date: Sat, 19 Sep 2026 02:30:21 +0530
Subject: [PATCH] fix(security): redact delegated token in formatted output

---
 CHANGELOG.md                                               | 5 +++++
 .../createos/model/SandboxAccessTokenCreateResponse.java   | 7 ++++++-
 src/test/java/sh/createos/CreateOsClientTest.java          | 1 +
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a093dbd..a461dd3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,11 @@ Versioning and the Keep a Changelog structure.
 
 ## Unreleased
 
+### Fixed
+
+- Redact plaintext sandbox access tokens from response `toString()` output to
+  prevent accidental disclosure in logs.
+
 ### Changed
 
 - Set the next Maven version and default user agent to `0.1.2`.
diff --git a/src/main/java/sh/createos/model/SandboxAccessTokenCreateResponse.java b/src/main/java/sh/createos/model/SandboxAccessTokenCreateResponse.java
index 5733172..da810a0 100644
--- a/src/main/java/sh/createos/model/SandboxAccessTokenCreateResponse.java
+++ b/src/main/java/sh/createos/model/SandboxAccessTokenCreateResponse.java
@@ -8,4 +8,9 @@ public record SandboxAccessTokenCreateResponse(
     String token,
     boolean enabled,
     @JsonProperty("created_at") Instant createdAt,
-    @JsonProperty("rotated_at") Instant rotatedAt) {}
+    @JsonProperty("rotated_at") Instant rotatedAt) {
+  @Override
+  public String toString() {
+    return "SandboxAccessTokenCreateResponse[token=[REDACTED], enabled=" + enabled + "]";
+  }
+}
diff --git a/src/test/java/sh/createos/CreateOsClientTest.java b/src/test/java/sh/createos/CreateOsClientTest.java
index 896bffe..0574bb0 100644
--- a/src/test/java/sh/createos/CreateOsClientTest.java
+++ b/src/test/java/sh/createos/CreateOsClientTest.java
@@ -241,6 +241,7 @@ void sandboxAccessTokenLifecycleUsesOwnerAndDelegatedCredentials() {
     Sandbox owner = client().getSandbox("sb-1");
     var created = owner.createAccessToken();
     assertEquals("skp_sb_first", created.token());
+    assertFalse(created.toString().contains(created.token()));
     assertEquals("skp_sb...irst", owner.getAccessToken().tokenHint());
     Sandbox worker = owner.withAccessToken(created.token());
     assertEquals(