NodeOps-app
diff --git a/‎CHANGELOG.md‎
Lines changed: 5 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎src/createos/models.py‎
Lines changed: 1 addition & 1 deletion b/‎src/createos/models.py‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎tests/test_sdk.py‎
Lines changed: 2 additions & 0 deletions b/‎tests/test_sdk.py‎
Lines changed: 2 additions & 0 deletions
@@ -17,6 +17,11 @@ Versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed
+
+- Redact plaintext sandbox access tokens from response representations to
+  prevent accidental disclosure in logs.
+
 ### Changed
 
 - Set the next package version to `0.1.3` on the patch release line.
 
@@ -592,7 +592,7 @@ class Sandbox(Model):
 class SandboxAccessTokenCreateResponse(Model):
     """Plaintext delegated token returned only on creation or rotation."""
 
-    token: str
+    token: str = field(repr=False)
     enabled: bool
     created_at: datetime
     rotated_at: datetime | None = None
 
@@ -82,6 +82,8 @@ def handler(request):
     sandbox = client.get_sandbox("sb-1")
     created = sandbox.create_access_token()
     assert created.token == "skp_sb_first" and created.created_at.year == 2026
+    assert created.token not in repr(created)
+    assert "enabled=True" in repr(created)
     assert sandbox.get_access_token().token_hint == "skp_sb...irst"
     worker = sandbox.with_access_token(created.token)
     assert worker is not sandbox and worker.files is not sandbox.files