{
  "slug": "pulumi-cli-redacts-secrets-in-property-values-in-logs-eeb37e81003d",
  "title": "Pulumi CLI redacts secrets in property values in logs",
  "tools": [
    "pulumi"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-07-23T15:10:53.000Z",
  "announced_at": "2026-07-23T15:10:53.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When inspecting Pulumi CLI logs, rely on default best-effort redaction of secrets in property values. To allow secrets through as before, run the Pulumi command with `--logsecrets` (redaction is not guaranteed to remove every secret).",
    "examples": [
      "pulumi <command> --logsecrets"
    ],
    "gotchas": [
      "Version: 3.254.0",
      "--logsecrets: Disables secret redaction in logs and allows secrets through as before.",
      "Redaction is a best effort and does not guarantee that logs contain no secrets."
    ]
  },
  "why_it_matters": "Inspect Pulumi logs that may contain secret property values.",
  "before": "Pulumi logs allowed secrets through, without the new redaction behavior.",
  "sources": [
    "https://github.com/pulumi/pulumi/releases/tag/v3.254.0",
    "https://github.com/pulumi/pulumi/pull/23931"
  ],
  "rank": 0.9003,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-db92204a075abc3e-18:gate",
    "evidence_hash": "9147e70e72029a01014200c42dbc3aba7fcc4b548c9090eafe541348506ba681"
  },
  "review": {
    "draft_hash": "0c8b1c01c1bf4c715e068d83c4ca3ecc530640060a74641c1a484dbac96a62c4",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.90 >= 0.9; 2 needed) and Jev gave 0.68 (>= 0.6 needed)."
  }
}