From c1a82a2fa59acb0983d8da55f9b5f5cf72f27930 Mon Sep 17 00:00:00 2001
From: James Mackay <NotExpectedYet>
Date: Fri, 9 Oct 2026 07:47:12 +0100
Subject: [PATCH] fix(diagnostics): hosts join the explicit TO_REDACT list per
 the audit's G14 citation (t30 G14)

---
 custom_components/nvidia_shield/diagnostics.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/custom_components/nvidia_shield/diagnostics.py b/custom_components/nvidia_shield/diagnostics.py
index fd6de07..1a3f7ff 100644
--- a/custom_components/nvidia_shield/diagnostics.py
+++ b/custom_components/nvidia_shield/diagnostics.py
@@ -22,14 +22,18 @@ from .connection import ShieldConnectionManager
 _REDACT_KEY_MARKERS = ("pairing", "pin", "secret", "password", "token", "key_material")
 _REDACTED = "**REDACTED**"
 
-# G14: the documented explicit redaction field list (host paths stay
-# readable; pairing/key-shaped fields are masked by async_redact_data).
+# G14: the documented explicit redaction field list — the audit calls out
+# config fields like the hosts; pairing/key-shaped fields are masked by
+# async_redact_data and the marker scan adds a second layer.
 _TO_REDACT = {
     "pairing_code",
     "adb_pairing_code",
     "protocol_pairing_code",
     "serial_number",
     "uuid",
+    "adb_host",
+    "protocol_host",
+    "host",
 }