Private/Protect-SCASecret.ps1

function Protect-SCASecret {
    <#
    .SYNOPSIS
        Masks sensitive values before they reach Verbose, Debug, or error output.
    .DESCRIPTION
        Accepts a string or a hashtable (typically HTTP headers or a request/response body) and
        returns a copy with values belonging to sensitive keys replaced with a fixed redaction
        marker. Matching is case-insensitive and matches on key substrings, since services vary
        header casing and naming (Authorization, X-Auth-Token, ClientSecret, refresh_token, ...).
    .PARAMETER InputObject
        The string or hashtable/dictionary to redact.
    .EXAMPLE
        Protect-SCASecret -InputObject @{ Authorization = 'Bearer eyJ...'; Accept = 'application/json' }

        Returns a copy of the hashtable with Authorization replaced by '***REDACTED***'.
    .OUTPUTS
        System.String or System.Collections.Hashtable, matching the input type.
    #>

    [CmdletBinding()]
    [OutputType([string], [hashtable])]
    param(
        [Parameter(Mandatory, Position = 0)]
        [AllowNull()]
        [object]$InputObject
    )

    $sensitiveKeyPattern = 'authorization|bearer|token|clientsecret|client_secret|password|secret|cookie|credential|privatekey|private_key'

    if ($null -eq $InputObject) {
        return $InputObject
    }

    if ($InputObject -is [System.Collections.IDictionary]) {
        $redacted = @{}
        foreach ($key in $InputObject.Keys) {
            if ($key -match $sensitiveKeyPattern) {
                $redacted[$key] = '***REDACTED***'
            }
            else {
                $redacted[$key] = $InputObject[$key]
            }
        }
        return $redacted
    }

    if ($InputObject -is [string]) {
        $text = $InputObject
        $text = $text -replace '(?i)("(?:access_token|refresh_token|client_secret|password|secret)"\s*:\s*)"[^"]*"', '$1"***REDACTED***"'
        $text = $text -replace '(?i)(Bearer\s+)[A-Za-z0-9\-\._~\+/]+=*', '$1***REDACTED***'
        $text = $text -replace '(?i)(Basic\s+)[A-Za-z0-9\+/]+=*', '$1***REDACTED***'
        return $text
    }

    return $InputObject
}