Sanitize ApiException in secret retrieval path to prevent token leakage

[spbsoluble]

Problem

When GetStaticSecret or GetSecretValuesAsync throw an ApiException, the exception escapes to callers unsanitized. The ApiException.Message from the Akeyless SDK can echo back portions of the request body, which includes the live auth token.

Unlike InitClient (which catches and sanitizes ApiException), the retrieval path lets the raw exception propagate, wrapping it in an AggregateException that bubbles to Keyfactor Command's logs.

Risk

A failure mode in secret retrieval that produces a diagnostic error message could expose the live Akeyless API token in Command's logs or error responses, where it may be captured by log aggregation, monitoring, or support tickets.

Solution

Catch ApiException in GetStaticSecret, extract the HTTP status code and Akeyless error structure from the response (without echoing Message), and throw a domain exception (InvalidSecretConfigurationException or similar) with a sanitized, actionable message.

Model after the pattern in InitClient (AkeylessPam.cs:174–183).

Related

• Customer fragment error (2026-08-19) was benign but exposed this gap
• Follows the existing logging discipline: never log credential-bearing fields