From 33874de17507359ccfa114a14fd268548c612dea Mon Sep 17 00:00:00 2001
From: Koshkoshinsk <daniel.milliner@gmail.com>
Date: Thu, 19 Mar 2026 21:17:55 +0000
Subject: [PATCH] fix: strip api_key from dry-run output shown to user

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 scripts/send-diagnostics.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/send-diagnostics.ts b/scripts/send-diagnostics.ts
index 157307c..80d5124 100644
--- a/scripts/send-diagnostics.ts
+++ b/scripts/send-diagnostics.ts
@@ -296,7 +296,9 @@ async function main(): Promise<void> {
     const payload = buildPayload(event, systemInfo, data, success);
 
     if (dryRun) {
-      console.log(JSON.stringify(payload, null, 2));
+      // Strip secrets before showing to user
+      const { api_key, ...visible } = payload;
+      console.log(JSON.stringify(visible, null, 2));
       return;
     }