{
  "$schema": "https://next.mdxui.dev/schema.json",
  "theme": "certificate",
  "frame": "sheet",
  "template": "post",
  "title": "0.9: secrets masked by default · Diffkeel",
  "description": "Every key that looks like a secret is masked unless the config says otherwise.",
  "meta": {"type":"article"},
  "sections": [
    {
      "kind": "nav",
      "shell": {"inset":"bleed","density":"none","surface":"glass","sticky":true},
      "block": {
        "type": "nav",
        "menu": "none",
        "brand": {"href":"/","text":"diffkeel","mark":"git-commit-horizontal"},
        "links": [["/docs/first-diff","Docs"],["/changelog","Changelog"],["/pricing","Pricing"]],
        "cta": {"href":"/install","label":"Install"}
      }
    },
    {
      "kind": "article",
      "shell": {"inset":"article","density":"article"},
      "block": {
        "type": "article",
        "head": {
          "back": {"href":"/changelog","label":"Changelog"},
          "tag": "0.9",
          "dateline": {"date":"2026-10-06","read":{"minutes":3,"unit":"min read"}},
          "title": "0.9: secrets masked by default",
          "dek": "Every key that looks like a secret is masked unless the config says otherwise. Masked changes print a short hash."
        },
        "body": "Before 0.9, a secret was masked only when `mask` named it. A key nobody listed printed in full, in a CI log anyone on the team could read.\n\n## What changed\n\n- Keys ending in `_PASSWORD`, `_TOKEN`, `_SECRET` or `_KEY` are masked with no config.\n- A masked change prints the first four characters of a SHA-256 hash, before and after.\n- `unmask` in `diffkeel.toml` opts a key out, by name.\n\n```diff\n@@ prod.env @@\n-PAYMENTS_API_KEY: ******** (a1f3)\n+PAYMENTS_API_KEY: ******** (9c07)\n```\n\n## Upgrading\n\n```console\n$ diffkeel self-update\ndiffkeel 0.8.2 to 0.9.0\n```\n\nA config that relied on a printed secret now shows a hash instead. Add the key to `unmask` to print it again."
      }
    },
    {
      "kind": "footer",
      "shell": {"inset":"contained","density":"footer"},
      "block": {
        "type": "footer",
        "layout": "columns",
        "brand": {"href":"/","text":"diffkeel","mark":"git-commit-horizontal"},
        "blurb": "A CLI that renders each environment’s config and diffs it before it deploys.",
        "columns": [
          {
            "title": "Product",
            "links": [
              ["/install","Install"],
              ["/docs/first-diff","Your first diff"],
              ["/changelog","Changelog"],
              ["/pricing","Pricing"]
            ]
          },
          {
            "title": "For agents",
            "links": [
              ["/docs/first-diff","The agent prompt"],
              ["/pricing","The Team API"],
              ["/records.zip","Site records (.zip)"]
            ]
          },
          {"title":"Diffkeel","links":[["/contact","Contact"]]}
        ],
        "note": [
          "Diffkeel is a worked example on mdxui.dev, not a customer.",
          "Rendered by @mdxui/site. Forms here do not send."
        ]
      }
    }
  ]
}