# Obfuscating encrypted variables in the logs

**URL:** <https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209>\
**Category:** Pipeline Workflows\
**Created:** [October 18, 2019, 12:56pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209 "2019-10-18T12:56:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![evanx9](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/evanx9/32/156_2.png) [@evanx9](https://community.codefresh.io/u/evanx9)\
**Post date:** [October 18, 2019, 12:56pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209/1 "2019-10-18T12:56:46Z")

</div>

We use some scripts in the pipeline that require credentials or keys, and we encrypt in Codefresh.

However, when the scripts run, the credentials/keys are exposed in the console logs.

Is there a way to prevent this or turn on a mode where it replaces the encrypted value with “\*\*\*\*\*”? Then, if we need to see the variable, it would be a click to reveal.

Understandably, this may require another security layer that would allow admins to view this information.

---

<div class="post-metadata">

**Author:** ![todaywasawesome](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/todaywasawesome/32/91_2.png) [@todaywasawesome](https://community.codefresh.io/u/todaywasawesome)\
**Post date:** [October 22, 2019, 4:12pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209/2 "2019-10-22T16:12:29Z")

</div>

The two ways I can think of to accomplish this would be

1. Use a separate pipeline that people don’t have access to but you can run from this pipeline with logs off. This would keep the output “blackbox” essentially. There are some downsides here like having a separate volume etc.
2. Run the step in freestyle mode and manually suppress the output with a pipe to /dev/null

---

<div class="post-metadata">

**Author:** ![michal](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/michal/32/72_2.png) [@michal](https://community.codefresh.io/u/michal)\
**Post date:** [October 22, 2019, 4:19pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209/3 "2019-10-22T16:19:05Z")

</div>

Could we treat this as feature, please? Badly needed fwiw. Jenkins can do it automatically, for example, by obfuscating output of what it knows to be secrets… it’s not perfect, but at least something.

---

<div class="post-metadata">

**Author:** ![kristofer](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/kristofer/32/19_2.png) [@kristofer](https://community.codefresh.io/u/kristofer)\
**Post date:** [October 22, 2019, 4:28pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209/4 "2019-10-22T16:28:59Z")

</div>

For sure, it’s a very good feature request, and I’ll check in to see where we can place it in our pipeline. 🙂

---

<div class="post-metadata">

**Author:** ![todaywasawesome](https://sea1.discourse-cdn.com/flex019/user_avatar/community.codefresh.io/todaywasawesome/32/91_2.png) [@todaywasawesome](https://community.codefresh.io/u/todaywasawesome)\
**Post date:** [July 20, 2020, 4:52pm UTC](https://community.codefresh.io/t/obfuscating-encrypted-variables-in-the-logs/209/5 "2020-07-20T16:52:41Z")

</div>

Automatic secret masking came out in May and I totally missed it! Check it out [Variables · Codefresh | Docs](https://codefresh.io/docs/docs/codefresh-yaml/variables/#masking-variables-in-logs)