Module secrets 

Secret masking. The value of every environment variable named DRE_SECRET_*, and of every environment variable profiles.yml reads through env_var() into a secret field (one the plugin declares secret, or named like password, token, api_key), is replaced by ***** in everything DRE writes for people to read: the console, logs/dre.log, JSON events, run_results.json and the compiled SQL in target/compiled/. The SQL actually sent to the database is unchanged. mask_secrets: false in dre_project.yml turns masking off.

JSON is redacted structurally, before it is serialized: serializing escapes ", \ and control characters, so masking the finished text would miss a secret that contains them. Use to_json_pretty / to_json_line for every JSON surface, never mask on JSON text.

Every value is masked, however short. One shorter than 4 characters is masked where it stands alone (not inside a longer word or number), so a PIN of 12 masks PIN 12 but leaves 2012 readable.

Constants

MASK

MASKED_SOURCE_ERROR

PREFIX

Functions

contains_secret

Whether masking is enabled and s contains a complete registered secret.

env_references

The environment variables a template reads through env_var('NAME') (either quote).

mask

s with every secret value replaced by *****.

mask_source_error

Mask a source error before it reaches logs or output. Source plugins can transform or truncate a request in their diagnostics, so exact replacement is not sufficient for a secret-bearing request. In that case the opaque detail is omitted instead.

redact_json

v with every secret value replaced by ***** in all strings and object keys. Colliding masked keys receive #2, #3, and so on rather than silently replacing another entry.

register_secret_field

Mask the values of the environment variables a secret profile field reads through env_var(), at any depth of value.

register_secret_fields

Mask the env_var() values that the secret fields of fields (a profile target) read, nested blocks (ssh:) included. secret adds names a plugin declares secret.

register_values

Mask these values from now on: a query’s secret_columns.

secret_field_name

Whether a profile field’s name says it holds a secret. Paths, hosts and fingerprints don’t count (private_key_path, host_key_fingerprint): masking them would hide what a message is about, and they aren’t secrets.

set_enabled

to_json_line

One-line JSON of v with secrets redacted first.

to_json_pretty

Pretty JSON of v with secrets redacted first.