The OpenAI-compatible client's error echo leaks a key written with ordinary ASCII runes as JSON \u escapes when the body is not decodable JSON: a plain-text body, or a JSON body cut at maxErrorBodyBytes, falls to providerSaid's raw-text fallback, which only resolves HTML references before the scrub, and keyForms carries \u escapes for non-ASCII runes alone, so {"detail":"bad sk-<key> cut at the bound reaches stderr while the same body as valid JSON is scrubbed.

The OpenAI-compatible client's error echo leaks a key written with ordinary ASCII runes as JSON \u escapes when the body is not decodable JSON: a plain-text body, or a JSON body cut at maxErrorBodyBytes, falls to providerSaid's raw-text fallback, which only resolves HTML references before the scrub, and keyForms carries \u escapes for non-ASCII runes alone, so {"detail":"bad sk-<key> cut at the bound reaches stderr while the same body as valid JSON is scrubbed.

Grounds

• pursued: no key escaped rune by rune in JSON's escape forms, in a plain-text or truncated body, reaches an error; shown wrong by an undecodable body carrying such a key that TestAnEscapedKeyInAnUndecodableBodyIsScrubbed would then fail on