openssl_encrypt printed derived hardware pepper values during its HSM test commands. The repair removes those values from command output while retaining the success and length messages.

@@ -1947,0 +2080,18 @@+        result = plugin.get_hsm_pepper(test_salt, context)++        if result.success:+            pepper = result.data.get("hsm_pepper")+            print(f"\n✅ Test successful!")+            print(f"Pepper length: {len(pepper)} bytes")+            print(f"Pepper (hex): {pepper.hex()}")+            print("\nYour FIDO2 credential is working correctly.")+        else:+            print(f"\n❌ Test failed: {result.message}")

+            sys.exit(1)++    elif action == "fido2-list":+        # List connected FIDO2 devices+        print("\n🔐 Connected FIDO2 Devices")+        print("=" * 50)++        devices = plugin.list_devices()

@@ -2671,9 +2671,11 @@             pepper = result.data.get("hsm_pepper")             eprint("\n✅ Test successful!")+            # Do NOT print the pepper itself — it is key material / a KDF+            # intermediate (H1 [HSM-1], gitlab#121). The length + success+            # confirm the derivation works; the value must never reach output.             eprint(f"Pepper length: {len(pepper)} bytes")-            eprint(f"Pepper (hex): {pepper.hex()}")             eprint("\nYour FIDO2 credential is working correctly.")         else:             eprint(f"\n❌ Test failed: {result.message}")

             sys.exit(1)