fix(hmac): don't include the HMAC key in the invalid key exception

src/main/java/com/adyen/util/HMACValidator.java

@@ -73,7 +73,8 @@ public String calculateHMAC(String data, String key)
     } catch (IllegalArgumentException e) {
       throw new IllegalArgumentException("Missing data or key: " + e.getMessage());
     } catch (DecoderException e) {
-      throw new IllegalArgumentException("Invalid Hex HMAC key: " + key);
+      throw new IllegalArgumentException(
+          "Invalid Hex HMAC key: it must be a hexadecimal string with an even number of characters");
     } catch (Exception e) {
       throw new SignatureException("Failed to generate HMAC: " + e.getMessage());
     }

src/test/java/com/adyen/util/HMACValidatorTest.java

@@ -22,6 +22,7 @@
 package com.adyen.util;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -186,7 +187,20 @@ public void testCalculateHMACInvalidKeyFormat() {
         assertThrows(
             IllegalArgumentException.class,
             () -> new HMACValidator().calculateHMAC("TestPayload", "BadKey"));
-    assertEquals("Invalid Hex HMAC key: BadKey", exception.getMessage());
+    assertEquals(
+        "Invalid Hex HMAC key: it must be a hexadecimal string with an even number of characters",
+        exception.getMessage());
+  }
+
+  @Test
+  public void testCalculateHMACInvalidKeyIsNotInMessage() {
+    // A key with quotes left around it fails the hex check; the secret must not reach the logs.
+    String quotedKey = "\"" + HMAC_KEY + "\"";
+    IllegalArgumentException exception =
+        assertThrows(
+            IllegalArgumentException.class,
+            () -> new HMACValidator().calculateHMAC("TestPayload", quotedKey));
+    assertFalse(exception.getMessage().contains(HMAC_KEY));
   }
 
   @Test