From aab4da6aa5af484fabd70052342ea749fc19b9a3 Mon Sep 17 00:00:00 2001
From: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>
Date: Wed, 21 Oct 2026 21:44:22 +0530
Subject: [PATCH 1/2] fix(telemetry): keep mysql's -P port and redact the real
 -p password

The mysql credential rule's i flag let the attached port form -P3306 match as if it were -p, so the port was redacted as a secret and a real password later in the same command survived into OTLP export. Make the rule case-sensitive like the sshpass rule (mysql is the same shape: -p is the password, -P is the port).

Fixes #815

Signed-off-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>
---
 server/src/telemetry/scrub.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/telemetry/scrub.ts b/server/src/telemetry/scrub.ts
index 731b4b8415..2b7dac5af0 100644
--- a/server/src/telemetry/scrub.ts
+++ b/server/src/telemetry/scrub.ts
@@ -57,7 +57,7 @@ const RULES: [RegExp, (match: string, ...groups: string[]) => string][] = [
   // `-psecret` for mysql and friends. Nothing separates them: a space means the password is asked for
   // at the prompt and the word after `-p` is the database, so only the attached form is redacted.
   [
-    /(\bmysql(?:dump)?\b(?:[^|;&\\\r\n]|\\[\s\S])*?(?:[ \t]|\\\r?\n)-p)("[^"]*"|'[^']*'|[^\s'"-]\S*)/gi,
+    /(\bmysql(?:dump)?\b(?:[^|;&\\\r\n]|\\[\s\S])*?(?:[ \t]|\\\r?\n)-p)("[^"]*"|'[^']*'|[^\s'"-]\S*)/g,
     (_m, lead) => `${lead}${REDACTED}`,
   ],
   // `docker login -p secret`, where `-p` is the password rather than a port.

From 416a044ce84708b66452bdadc384e4950dceefd5 Mon Sep 17 00:00:00 2001
From: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>
Date: Wed, 21 Oct 2026 21:44:55 +0530
Subject: [PATCH 2/2] test(telemetry): pin mysql -P port vs -p password
 scrubbing

Mixed -P3306/-phunter2 command keeps the port and redacts the password; lowercase attached form and mysqldump pinned alongside.

Signed-off-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>
---
 server/tests/enterprise-controls.test.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/server/tests/enterprise-controls.test.ts b/server/tests/enterprise-controls.test.ts
index d1da9ce03a..23927b95f9 100644
--- a/server/tests/enterprise-controls.test.ts
+++ b/server/tests/enterprise-controls.test.ts
@@ -359,6 +359,11 @@ describe("scrubbing commands", () => {
       "psql postgres://app:[REDACTED]@db:5432/app",
     ],
     ["mysql -uroot -phunter2 app", "mysql -uroot -p[REDACTED] app"],
+    // `-P` is mysql's port, not its password: the attached port must survive and the real
+    // password later in the same command must still be redacted (gh-815).
+    ["mysql -h db -P3306 -phunter2 app", "mysql -h db -P3306 -p[REDACTED] app"],
+    ["mysql -uroot -p3306 app", "mysql -uroot -p[REDACTED] app"],
+    ["mysqldump -phunter2 db", "mysqldump -p[REDACTED] db"],
     [
       "tool --password hunter2 --verbose",
       "tool --password [REDACTED] --verbose",