fix: sanitize parser sandbox error messages to prevent sensitive data leaks

backend/secuscan/executor.py

@@ -1702,7 +1702,7 @@ def _parse_results(self, plugin, output: str) -> Dict[str, Any]:
             except Exception as exc:
                 logger.error("Unexpected error running parser sandbox for '%s': %s", plugin.id, exc)
                 raise RuntimeError(
-                    f"Custom parser encountered an unexpected error for plugin '{plugin.id}'"
+                    f"Custom parser encountered an unexpected error for plugin '{plugin.id}': {redact(str(exc))}"
                 ) from exc
 
         # 2. Fallback to legacy built-in parsers (only reached when no parser.py exists)

backend/secuscan/parser_sandbox.py

@@ -51,6 +51,8 @@
 from pathlib import Path
 from typing import Any, Dict
 
+from .redaction import redact
+
 logger = logging.getLogger(__name__)
 
 # Defaults — overridden by the Settings values passed at call time.
@@ -84,11 +86,11 @@ class ParserSandboxError(RuntimeError):
     def __init__(self, plugin_id: str, reason: str, stderr: str = "") -> None:
         self.plugin_id = plugin_id
         self.reason = reason
-        # Keep stderr private; callers must not surface this to API consumers.
+        sanitized = redact(stderr[:2000]) if stderr else ""
         self._stderr_diagnostic: str = stderr
-        self.stderr_excerpt = stderr[:2000] if stderr else ""
-        # User-facing message: reason only — no stderr content.
-        super().__init__(f"Parser sandbox failed for '{plugin_id}' ({reason})")
+        self.stderr_excerpt = sanitized
+        detail = f": {sanitized[:200]}" if sanitized.strip() else ""
+        super().__init__(f"Parser sandbox failed for '{plugin_id}' ({reason}){detail}")
 
 
 # ---------------------------------------------------------------------------