fix: always redact sensitive rejected values

examples/boot2-example/pom.xml

@@ -9,7 +9,7 @@
     </parent>
     <groupId>dev.flyfish.validation.example</groupId>
     <artifactId>flyfish-validation-boot2-example</artifactId>
-    <version>1.0.0</version>
+    <version>1.0.1-SNAPSHOT</version>
     <name>Flyfish Validation Boot 2 Example</name>
     <properties>
         <java.version>8</java.version>
@@ -18,7 +18,7 @@
         <dependency>
             <groupId>dev.flyfish</groupId>
             <artifactId>flyfish-validation-spring-boot2-starter</artifactId>
-            <version>1.0.0</version>
+            <version>1.0.1-SNAPSHOT</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>

examples/boot3-example/pom.xml

@@ -9,7 +9,7 @@
     </parent>
     <groupId>dev.flyfish.validation.example</groupId>
     <artifactId>flyfish-validation-boot3-example</artifactId>
-    <version>1.0.0</version>
+    <version>1.0.1-SNAPSHOT</version>
     <name>Flyfish Validation Boot 3 Example</name>
     <properties>
         <java.version>17</java.version>
@@ -18,7 +18,7 @@
         <dependency>
             <groupId>dev.flyfish</groupId>
             <artifactId>flyfish-validation-spring-boot3-starter</artifactId>
-            <version>1.0.0</version>
+            <version>1.0.1-SNAPSHOT</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>

examples/boot4-example/pom.xml

@@ -9,7 +9,7 @@
     </parent>
     <groupId>dev.flyfish.validation.example</groupId>
     <artifactId>flyfish-validation-boot4-example</artifactId>
-    <version>1.0.0</version>
+    <version>1.0.1-SNAPSHOT</version>
     <name>Flyfish Validation Boot 4 Example</name>
     <properties>
         <java.version>17</java.version>
@@ -18,7 +18,7 @@
         <dependency>
             <groupId>dev.flyfish</groupId>
             <artifactId>flyfish-validation-spring-boot4-starter</artifactId>
-            <version>1.0.0</version>
+            <version>1.0.1-SNAPSHOT</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>

flyfish-validation-bom/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-bom</artifactId>
     <packaging>pom</packaging>

flyfish-validation-core/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-core</artifactId>
     <packaging>jar</packaging>

flyfish-validation-jakarta/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-jakarta</artifactId>
     <packaging>jar</packaging>

flyfish-validation-javax/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-javax</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot2-autoconfigure/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot2-autoconfigure</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot2-starter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot2-starter</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot3-autoconfigure/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot3-autoconfigure</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot3-starter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot3-starter</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot4-autoconfigure/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot4-autoconfigure</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-boot4-starter/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-boot4-starter</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-support/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>dev.flyfish</groupId>
         <artifactId>flyfish-validation-parent</artifactId>
-        <version>1.0.0</version>
+        <version>1.0.1-SNAPSHOT</version>
     </parent>
     <artifactId>flyfish-validation-spring-support</artifactId>
     <packaging>jar</packaging>

flyfish-validation-spring-support/src/main/java/dev/flyfish/validation/spring/DefaultValidationRejectedValueSanitizer.java

@@ -5,6 +5,7 @@
 import java.util.Collection;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 
 import dev.flyfish.validation.api.ValidationError;
@@ -20,6 +21,11 @@ public final class DefaultValidationRejectedValueSanitizer
     implements ValidationRejectedValueSanitizer {
 
     private static final int MAX_ATTRIBUTE_DEPTH = 4;
+    private static final String[] SENSITIVE_PATH_FRAGMENTS = {
+        "authorization", "cookie", "password", "passwd", "secret", "token",
+        "apikey", "accesskey", "privatekey", "credential", "sessionid",
+        "jsessionid", "otp", "cvv", "bankcard", "idcard"
+    };
 
     private final boolean exposeRejectedValue;
     private final boolean exposeAttributes;
@@ -40,7 +46,12 @@ public ValidationError sanitize(ValidationError error) {
             .propertyPath(error.getPropertyPath())
             .severity(error.getSeverity())
             .validator(error.getValidator());
-        if (exposeRejectedValue) {
+        /*
+         * The general exposure switch is useful for harmless fields, but it must never override
+         * the sensitive-field denylist. Otherwise a diagnostics setting could reflect passwords,
+         * tokens, or credentials into API responses and logs without any warning at the call site.
+         */
+        if (exposeRejectedValue && !isSensitivePath(error.getPropertyPath())) {
             builder.rejectedValue(simpleValue(error.getRejectedValue(), 0));
         }
         if (exposeAttributes) {
@@ -53,6 +64,24 @@ public ValidationError sanitize(ValidationError error) {
         return builder.build();
     }
 
+    private static boolean isSensitivePath(String propertyPath) {
+        if (propertyPath == null || propertyPath.isEmpty()) {
+            return false;
+        }
+        String normalized = propertyPath.toLowerCase(Locale.ROOT)
+            .replace("_", "")
+            .replace("-", "")
+            .replace(".", "")
+            .replace("[", "")
+            .replace("]", "");
+        for (String fragment : SENSITIVE_PATH_FRAGMENTS) {
+            if (normalized.contains(fragment)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     private static Object simpleValue(Object value, int depth) {
         if (value == null || value instanceof String
             || value instanceof Number || value instanceof Boolean

flyfish-validation-spring-support/src/test/java/dev/flyfish/validation/spring/DefaultValidationRejectedValueSanitizerTest.java

@@ -0,0 +1,35 @@
+package dev.flyfish.validation.spring;
+
+import dev.flyfish.validation.api.ValidationError;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/** 敏感字段即使启用 rejected value 诊断开关也必须保持脱敏。 */
+class DefaultValidationRejectedValueSanitizerTest {
+
+    private final DefaultValidationRejectedValueSanitizer sanitizer =
+        new DefaultValidationRejectedValueSanitizer(true, false);
+
+    @Test
+    void exposesRejectedValueForOrdinaryFieldsWhenExplicitlyEnabled() {
+        ValidationError error = error("displayName", "张三");
+
+        assertEquals("张三", sanitizer.sanitize(error).getRejectedValue());
+    }
+
+    @Test
+    void neverExposesSensitiveRejectedValues() {
+        // 离线兼容检查使用最小 JUnit API 桩；用标准等值断言保持测试语义且不扩大桩接口。
+        assertEquals(null, sanitizer.sanitize(error("password", "Plaintext-Secret")).getRejectedValue());
+        assertEquals(null, sanitizer.sanitize(error("credentials.clientSecret", "secret")).getRejectedValue());
+        assertEquals(null, sanitizer.sanitize(error("oauth.access_token", "token")).getRejectedValue());
+    }
+
+    private static ValidationError error(String propertyPath, Object rejectedValue) {
+        return ValidationError.builder("INVALID", "校验失败")
+            .propertyPath(propertyPath)
+            .rejectedValue(rejectedValue)
+            .build();
+    }
+}

pom.xml

@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>dev.flyfish</groupId>
     <artifactId>flyfish-validation-parent</artifactId>
-    <version>1.0.0</version>
+    <version>1.0.1-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Flyfish Validation</name>
     <description>面向 Java 8-21 与 Spring Boot 2/3/4 的企业级验证增强库</description>