From: Stefan Gasser <redacted>
Date: Wed, 10 Jun 2026 12:32:05 +0000 (+0200)
Subject: Use correct double-bracket placeholder format in comments and docs
X-Git-Tag: v0.4.2~1^2
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=fb98d4025281088c3ada4b31cf9e332d6695dd71;p=sgasser-llm-shield.git

Use correct double-bracket placeholder format in comments and docs
---

diff --git a/docs/configuration/logging.mdx b/docs/configuration/logging.mdx
index d610d13..bcef0c2 100644
--- a/docs/configuration/logging.mdx
+++ b/docs/configuration/logging.mdx
@@ -74,4 +74,4 @@ Only metadata (timestamps, models, PII detected) is logged.
 - Raw request/response content is **never** logged — only the masked version, and only when `log_masked_content` is enabled
 - With `secrets_detection.action: route_local`, content is not logged at all when secrets are detected, since secrets stay unmasked for the local provider
 - Only secret types are logged if `log_detected_types: true`
-- Masked content shows placeholders like `[[EMAIL_ADDRESS_1]]` and `[API_KEY_SK_1]`, not real values
+- Masked content shows placeholders like `[[EMAIL_ADDRESS_1]]` and `[[API_KEY_SK_1]]`, not real values
diff --git a/src/services/log-content.test.ts b/src/services/log-content.test.ts
index 782f713..433e79e 100644
--- a/src/services/log-content.test.ts
+++ b/src/services/log-content.test.ts
@@ -3,9 +3,9 @@ import { shouldLogMaskedContent } from "./log-content";
 
 describe("shouldLogMaskedContent", () => {
   // With action "mask", maskedContent has both PII and secrets replaced by
-  // placeholders, e.g. "My key is [API_KEY_SK_1] and email [[EMAIL_ADDRESS_1]]".
+  // placeholders, e.g. "My key is [[API_KEY_SK_1]] and email [[EMAIL_ADDRESS_1]]".
   // Storing it is safe even when secrets were detected (issue #91).
-  const maskedWithSecret = "My key is [API_KEY_SK_1] and email [[EMAIL_ADDRESS_1]]";
+  const maskedWithSecret = "My key is [[API_KEY_SK_1]] and email [[EMAIL_ADDRESS_1]]";
   const maskedPiiOnly = "Email [[EMAIL_ADDRESS_1]]";
 
   test("logs masked content when secrets were detected and masked", () => {
diff --git a/src/services/log-content.ts b/src/services/log-content.ts
index 10233f8..94f9301 100644
--- a/src/services/log-content.ts
+++ b/src/services/log-content.ts
@@ -9,7 +9,7 @@ export interface LogContentDecision {
  * Decide whether masked content should be persisted to the request log.
  *
  * When secrets_detection.action is "mask" (the default), maskedContent has both
- * PII and secrets replaced by placeholders (e.g. "[API_KEY_SK_1]",
+ * PII and secrets replaced by placeholders (e.g. "[[API_KEY_SK_1]]",
  * "[[EMAIL_ADDRESS_1]]") by the time it reaches the logger, so it is safe to
  * store even when secrets were detected — gating follows log_masked_content.
  *