[bencehezso]

Summary

The egress PDF's "Scope of Assessment" table printed the AWS Access Key ID in full and a masked Secret Key, or the Azure Client ID and a masked Client Secret, and run.log received the Azure client ID from MSAL's debug output. Both are files users share. The scope table now shows the same scope facts as page 2 of the Executive Summary, and nothing else, and MSAL no longer writes to the log.

Changes

Egress PDF

• Azure: Tenant ID, Subscription ID, Resource Group. AWS: Account ID (when known) and Region. Missing values show a dash. The tfstate rows and the layout are unchanged.
• The rows come from the same function as page 2 (scope_facts, formerly private), with the same labels.
• anonymize_string is removed; nothing else used it.

Logging

• msal is pinned to WARNING at every verbosity, because its debug output includes the client ID; urllib3 connection lines appear only at -vv.

Tests

• The scope-section tests are rewritten around the new rows and check that no row names or shows a credential.
• A guard runs a complete fixture run with egress for AWS and for Azure and scans every file of the report folder (PDF text, HTML, JSON, run.log) for each credential value and its first and last four characters; it is itself tested with planted values.
• Logging tests check the levels of msal and urllib3 at each verbosity.

Compatibility

Config, CLI flags, exit codes, the dataset and the API v2 definition copy are unchanged. Report output: the egress PDF's scope table loses the credential rows. run.log: no MSAL debug lines at any verbosity, and no urllib3 debug lines below -vv.