One-Character Regex Fix Closes Redis Password Leak in AI Context Tool

A security gap in ContextOS, an open-source context-packaging tool for AI coding agents, allowed Redis connection string passwords to pass through its secret-detection layer unredacted. The flaw stemmed from a regex pattern that required at least one character in the username segment of a database URL, which excluded the standard Redis URI format where no username is present. As a result, credentials like those in 'redis://:password@host' were silently handed to large language model agents in plain text. A developer discovered the issue while auditing detection coverage against real-world connection string formats and submitted a fix that changes a single character in the regex, from '+' to '*', to allow an empty username. Two regression tests were added and the full 952-test suite passed without regressions, closing the gap for all future Redis-based project scans.