{"record":{"id":"526f20297918835c","repo":"windmill-labs/windmill","slug":"config-contains-sensitive-fields-license-key-jwt","errorCode":null,"errorMessage":"Config contains sensitive fields (license_key, jwt_secret). They are masked by default.","messagePattern":"Config contains sensitive fields \\(license_key, jwt_secret\\)\\. They are masked by default\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"cli/src/commands/instance/instance.ts","lineNumber":676,"sourceCode":"  if (opts.instance) {\n    return opts.instance;\n  }\n  try {\n    return await readTextFile(await getActiveInstanceFilePath());\n  } catch {\n    return undefined;\n  }\n}\n\nasync function getConfig(opts: InstanceSyncOptions & { outputFile?: string; showSecrets?: boolean }) {\n  await pickInstance(opts, false);\n  const config = await wmill.getInstanceConfig() as any;\n\n  // In interactive mode, mask secrets by default and prompt\n  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;\n  let showSecrets = opts.showSecrets ?? false;\n  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {\n    log.warn(\"Config contains sensitive fields (license_key, jwt_secret). They are masked by default.\");\n    log.warn(\"Use --show-secrets to include them, or press Y to show them now.\");\n    showSecrets = await Confirm.prompt({ message: \"Show secrets?\", default: false });\n  } else if (!process.stdout.isTTY || opts.outputFile) {\n    // Non-interactive or writing to file: always include secrets\n    showSecrets = true;\n  }\n\n  if (!showSecrets && config?.global_settings) {\n    if (config.global_settings.license_key) config.global_settings.license_key = \"***\";\n    if (config.global_settings.jwt_secret) config.global_settings.jwt_secret = \"***\";\n  }\n\n  const yaml = yamlStringify(config as Record<string, unknown>);\n  if (opts.outputFile) {\n    await writeFile(opts.outputFile, yaml, \"utf-8\");\n    log.info(colors.green(`Instance config written to ${opts.outputFile}`));\n  } else {\n    console.log(yaml);","sourceCodeStart":658,"sourceCodeEnd":694,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/instance/instance.ts#L658-L694","documentation":"`wmill instance get-config` masks the sensitive instance config fields `license_key` and `jwt_secret` by default. In an interactive TTY (and not writing to a file) it warns that masking is active and offers `--show-secrets` or an inline Y/N confirm to reveal them.","triggerScenarios":"Running `wmill instance get-config` on an instance whose `global_settings.license_key` or `jwt_secret` is set, in an interactive terminal, without `--show-secrets` and without `--output-file`.","commonSituations":"Inspecting instance settings during debugging; documenting instance config; running the command in a terminal and wondering why secrets appear as masked.","solutions":["Pass `--show-secrets` when you intentionally need the raw values.","Answer Y at the 'Show secrets?' prompt for a one-off reveal.","Redirect output to a file (`--output-file`) if you need the full config; note non-TTY/file mode always includes secrets, so handle the file securely."],"exampleFix":"// before: secrets masked in output\nwmill instance get-config\n// after\nwmill instance get-config --show-secrets","handlingStrategy":"validation","validationCode":"// check whether the config will contain secrets before printing it\nconst cfg = await wmill.getInstanceConfig() as any;\nconst hasSecrets = Boolean(cfg?.global_settings?.license_key || cfg?.global_settings?.jwt_secret);\nif (hasSecrets && process.stdout.isTTY) {\n  console.log('secrets present — pass --show-secrets if you need raw values');\n}","typeGuard":"function hasSecrets(cfg: unknown): boolean {\n  const g = (cfg as any)?.global_settings;\n  return typeof g?.license_key === 'string' && g.license_key.length > 0 ||\n         typeof g?.jwt_secret === 'string' && g.jwt_secret.length > 0;\n}","tryCatchPattern":"try {\n  const cfg = await wmill.getInstanceConfig();\n} catch (e: any) {\n  if (/mask|show-secrets/i.test(e.message ?? '')) {\n    // rerun with --show-secrets or capture to a secured file\n  }\n  throw e;\n}","preventionTips":["Pass `--show-secrets` deliberately and never in shared terminals or CI logs.","When dumping full config, write to a secured file rather than stdout.","Remember non-TTY/file output includes secrets — scrub logs before sharing."],"tags":["cli","secrets","security","masking"],"backgroundTag":"sensitive-output-masked","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}