fix(devlog): stop the audit record from breaking its own privacy gate

[lidge-jun]

Summary

dev's gates job is red again, and this time my own audit record caused it.

The record documenting the shadow-marker leak pasted the reproduction transcript verbatim, including an sk--shaped value after a Bearer label. scripts/privacy-scan.ts matches those patterns wherever they appear:

100_release_audit.md:39 bearer-token: Bearer sk-...
100_release_audit.md:39 token-looking: sk-...

This is the same failure #2175 had just undone, reintroduced by the write-up describing it. Worth stating plainly rather than quietly fixing: I hit the exact hazard I had documented one commit earlier.

The scanner cannot tell a fake credential from a real one, and it should not have to. Writing the two cases as shapes keeps the finding intact — the point was never the literal bytes, it was that control characters are stripped before redaction and that the deny-list has no rule for one of the two families. Both facts survive the rewrite, with a note at the code block explaining why it is written that way.

Verification

• bun run privacy:scan — passed. Fails on dev without this change; verified both directions.

Docs-only; no runtime code touched.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

This removes credential-shaped strings from the tree rather than adding any.

Summary by CodeRabbit

• Documentation
  • Updated sanitizer examples to use clearly non-sensitive credential placeholders.
  • Preserved documentation of redaction behavior and privacy-scan warnings.
  • Cleaned up trailing whitespace.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e78926e5-c272-4ab8-aa0b-f990a8ad2284

📥 Commits

Reviewing files that changed from the base of the PR and between 4813181 and fabc448.

📒 Files selected for processing (1)

• devlog/_plan/260820_bug_pr_backlog_consolidation/100_release_audit.md

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The release audit replaces literal-looking bearer and Google API key examples with non-secret placeholders. It clarifies that the privacy scanner matches these patterns, including fake credentials, and removes a trailing blank line.

Changes

Release audit documentation

Layer / File(s)	Summary
Sanitize credential examples devlog/_plan/260820_bug_pr_backlog_consolidation/100_release_audit.md	Credential examples now use non-secret shapes. The audit documents matching behavior for fake credentials and removes the trailing blank line.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Merge Risk: ⚪ Minimal · up to fabc4

This localized documentation change removes credential-shaped strings while preserving the audit record’s explanation, and no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• lidge-jun/opencodex#2175: Updates the same release-audit document with safe credential placeholders.
• lidge-jun/opencodex#2174: Adds related audit content in the same release-audit document.

Suggested labels: documentation

Suggested reviewers: ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: preventing the audit record from triggering the privacy scan.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-audit-record-scan

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}