diff --git a/fix.go b/fix.go
new file mode 100644
index 0000000..9aafa1c
--- /dev/null
+++ b/fix.go
@@ -0,0 +1,10 @@
+package fix
+
+import "os"
+
+// FixLogRedirect redirects sensitive log output (like token refresh)
+// to stderr instead of stdout to prevent credential leakage in
+// command output that may be captured by CI/CD pipelines.
+func LogSensitive(msg string) {
+    os.Stderr.WriteString(msg + "\n")
+}