1"use strict";(self.webpackChunkwindmilldocs=self.webpackChunkwindmilldocs||[]).push([["18532"],{40235(e,t,a){a.r(t),a.d(t,{assets:()=>l,contentTitle:()=>o,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var s=a(51637),r=a(74848),n=a(28453);let i={slug:"secret-masking-job-logs",title:"Secret masking in job logs",tags:["Security"],description:"Windmill now masks secret values in job logs automatically, replacing all but the first 3 characters with stars and emitting a one-time notice. Masking happens in-memory so plaintext never lands in job_logs.",features:["Plaintext values of secret variables and $encrypted: arguments are tracked per-job and masked in stdout/stderr before logs are persisted.","First 3 characters are kept for debuggability; the rest is replaced by *****.",'Only values of 8 characters or more are masked, to avoid false positives like "true" or "1234".',"Masking happens in-memory before logs are written to the database, so plaintext never lands in job_logs."],docs:"/docs/core_concepts/variables_and_secrets#secret-masking-in-job-logs"},o,l={authorsImageUrls:[]},c=[];function g(e){return(0,r.jsx)(r.Fragment,{})}function d(e={}){let{wrapper:t}={...(0,n.R)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(g,{...e})}):g(e)}},28453(e,t,a){a.d(t,{R:()=>i,x:()=>o});var s=a(96540);let r={},n=s.createContext(r);function i(e){let t=s.useContext(n);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),s.createElement(n.Provider,{value:t},e.children)}},51637(e){e.exports=JSON.parse('{"permalink":"/changelog/secret-masking-job-logs","source":"@site/changelog/2026-03-12-secret-masking-job-logs/index.md","title":"Secret masking in job logs","description":"Windmill now masks secret values in job logs automatically, replacing all but the first 3 characters with stars and emitting a one-time notice. Masking happens in-memory so plaintext never lands in job_logs.","date":"2026-03-12T00:00:00.000Z","tags":[{"inline":true,"label":"Security","permalink":"/changelog/tags/security"}],"readingTime":0,"hasTruncateMarker":false,"authors":[],"frontMatter":{"slug":"secret-masking-job-logs","title":"Secret masking in job logs","tags":["Security"],"description":"Windmill now masks secret values in job logs automatically, replacing all but the first 3 characters with stars and emitting a one-time notice. Masking happens in-memory so plaintext never lands in job_logs.","features":["Plaintext values of secret variables and $encrypted: arguments are tracked per-job and masked in stdout/stderr before logs are persisted.","First 3 characters are kept for debuggability; the rest is replaced by *****.","Only values of 8 characters or more are masked, to avoid false positives like \\"true\\" or \\"1234\\".","Masking happens in-memory before logs are written to the database, so plaintext never lands in job_logs."],"docs":"/docs/core_concepts/variables_and_secrets#secret-masking-in-job-logs"},"unlisted":false,"prevItem":{"title":"Unified generate-metadata CLI command","permalink":"/changelog/unified-generate-metadata"},"nextItem":{"title":"Data tables as Postgres trigger sources","permalink":"/changelog/data-table-postgres-trigger"}}')}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.