diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index cfdf4ddc..1446dff3 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -7,3 +7,8 @@
 **Vulnerability:** execa re-injects unsanitized process.env by default when extendEnv is true.
 **Learning:** Using sanitizeEnvironment() but missing extendEnv: false defeated the purpose.
 **Prevention:** Always explicitly set extendEnv: false when passing a sanitized environment object to execa.
+
+## 2026-08-30 - Fix Quoted Secret Redaction Bypass
+**Vulnerability:** The redaction regex `KV_PATTERN` failed to match and redact quoted secret values (e.g., `password="mysecret"`), potentially leaking credentials in audit logs.
+**Learning:** Regular expressions for sanitizing key=value pairs must account for quoted values by explicitly including `"[^"]*"` and `'[^']*'` in the matching group.
+**Prevention:** When writing regex for secrets matching, always include patterns for both quoted and unquoted strings to prevent simple bypasses.
diff --git a/src/core/security/redaction.ts b/src/core/security/redaction.ts
index 4e6483b4..0e099ba0 100644
--- a/src/core/security/redaction.ts
+++ b/src/core/security/redaction.ts
@@ -105,7 +105,8 @@ const SIMPLE_PATTERNS: Array<RegExp> = [
   /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
 ];
 
-const KV_PATTERN = /(\b(?:token|secret|password|api[_-]?key)\b\s*[:=]\s*)([^\s,'"]+)/gi;
+const KV_PATTERN =
+  /(\b(?:token|secret|password|api[_-]?key)\b\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,'"]+)/gi;
 const QUERY_PATTERN = /([?&](?:token|secret|password|api_key|apikey)=)([^&\s]+)/gi;
 
 compiledPatterns = [...SIMPLE_PATTERNS];