feat: resolving issues

Author: Jemiiah

src/log_scrub.rs

@@ -76,12 +76,19 @@ fn patterns() -> &'static [(&'static str, Regex)] {
                 "bearer_token",
                 Regex::new(r"(?i)bearer\s+[A-Za-z0-9\-_=+/]{20,}").expect("bearer_token regex"),
             ),
-            // Raw base64 segments ≥ 40 chars (likely encoded key material or hashes)
-            // Excludes short segments common in k8s resource names / UIDs.
-            (
-                "base64_segment",
-                Regex::new(r"(?:[A-Za-z0-9+/]{40,}={0,2})").expect("base64_segment regex"),
-            ),
+                // Raw base64 segments that are likely secrets.
+                // We intentionally require either:
+                // - at least one '+' or '/' character, or
+                // - '=' padding at the end.
+                // This avoids false positives on Stellar StrKey public keys (G...)
+                // and other long plain alphanumeric identifiers.
+                (
+                    "base64_segment",
+                    Regex::new(
+                        r"(?:[A-Za-z0-9+/]{20,}[+/][A-Za-z0-9+/]{19,}={0,2}|[A-Za-z0-9+/]{40,}={1,2})",
+                    )
+                    .expect("base64_segment regex"),
+                ),
             // Hex strings ≥ 64 chars (SHA-256 or larger hashes of key material)
             (
                 "hex_hash",