The vulnerability stems from how secrets were masked in URL contexts. The commit diff shows the regex pattern in lib/hide-sensitive.js was modified to include both raw and URI-encoded versions of secrets. Prior to the fix, the regex only matched literal secret values (line 14 in original code), but didn't account for URI-encoded representations (e.g., spaces becoming %20). This allowed encoded secrets to appear unmasked in outputs. The function responsible for building the replacement regex is clearly identified in the diff as the root cause.