fix(security): Obfuscate API Key in output

config/config.go

@@ -118,7 +118,7 @@ func (f userFlags) MarshalJSON() ([]byte, error) {
 		BrowserURL:        f.BrowserURL,
 		Suites:            f.Suites,
 		Include:           f.Include,
-		APIKey:            f.APIKey,
+		APIKey:            obfuscateAPIKey(f.APIKey),
 		Region:            f.Region,
 		Script:            f.Script,
 		ScriptFlags:       f.ScriptFlags,
@@ -376,3 +376,16 @@ func stringToRegion(region string) Region {
 	}
 	return NoRegion
 }
+
+// obfuscateAPIKey - returns an obfuscated version of an API key showing only the first 6 characters
+func obfuscateAPIKey(apiKey string) string {
+	if apiKey == "" {
+		return ""
+	}
+	keyLen := len(apiKey)
+	if keyLen <= 6 {
+		return strings.Repeat("*", keyLen)
+	}
+
+	return apiKey[:6] + strings.Repeat("*", keyLen-6)
+}

config/config_test.go

@@ -308,3 +308,43 @@ func Test_parseRegionFlagAndEnv(t *testing.T) {
 		})
 	}
 }
+
+func Test_obfuscateAPIKey(t *testing.T) {
+	type args struct {
+		apiKey string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "Empty string returns empty string",
+			args: args{
+				apiKey: "",
+			},
+			want: "",
+		},
+		{
+			name: "Short key returns all asterisks",
+			args: args{
+				apiKey: "abcd",
+			},
+			want: "****",
+		},
+		{
+			name: "Standard 32-char API key shows first 6 + 26 asterisks",
+			args: args{
+				apiKey: "THIS-ISNTAREALAPIKEYOKAYTHANKYOU",
+			},
+			want: "THIS-I**************************",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := obfuscateAPIKey(tt.args.apiKey); got != tt.want {
+				t.Errorf("obfuscateAPIKey() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}