From a69fc0a95fe1dedaee149ddedc59d41b97540f4d Mon Sep 17 00:00:00 2001
From: Eugene Bobukh <eugenebo@microsoft.com>
Date: Fri, 24 Jul 2026 12:35:53 -0700
Subject: [PATCH] Regex fix for keyword_recall being redacted

---
 python/src/beval/reporter.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/src/beval/reporter.py b/python/src/beval/reporter.py
index 9b57252..fae417c 100644
--- a/python/src/beval/reporter.py
+++ b/python/src/beval/reporter.py
@@ -47,9 +47,9 @@
 }
 
 # Patterns identifying sensitive keys for scrubbing (§10.1).
-# Excludes keyword_recall and keyword_recall_stderr via negative lookbehind.
+# Excludes keyword_recall and keyword_recall_stderr.
 _SENSITIVE_KEY_RE = re.compile(
-    r"(?<!keyword_re)(secret|password|token|key|credential|auth|api.?key)",
+    r"^(?!keyword_recall(_stderr)?$).*(secret|password|token|key|credential|auth|api.?key)",
     re.IGNORECASE,
 )
 _REDACTED = "***REDACTED***"