speak-debug-bundle

The code is a legitimate diagnostic bundle generator, not clear malware, but it contains a high-severity credential disclosure bug in the complete script: set SPEAK_API_KEY and SPEAK_APP_ID values are written into the archive. Incomplete log redaction and unrestricted archive permissions create additional data-leakage risk. The credential-status expressions should output only a fixed marker such as `${SPEAK_API_KEY:+[SET]}` or `${SPEAK_API_KEY:+[SET]}${SPEAK_API_KEY:-[NOT SET]}` must be replaced with a conditional that never appends the value. Bundles should be reviewed, created with restrictive permissions, and scanned for secrets before sharing.