From 69dae41d9b4ab1186ebd276efde84a8180bfb7af Mon Sep 17 00:00:00 2001 From: Hannes Lenke Date: Wed, 28 Oct 2026 21:24:14 -0400 Subject: [PATCH] docs: secret scrubbing in API check results and Playwright traces (platform deploy 2026-10-28) API checks now store sensitive headers (Authorization, Proxy-Authorization, X-Api-Key, X-Auth-Token, Cookie, Set-Cookie) as the mask even without a secret inside, mask the URI-encoded spelling of a secret in the stored URL, query parameters and response body, and store the mask as the actual value of a header assertion on those headers. The exception list for trivial values (123, https:// and the others) now applies to API check results too. In Playwright traces a secret that is a JSON number or a field name is masked, and a secret written in a different letter case is not. Proven on the local stack at monorepo commit 5858d7e03f (go-runner and runtime 2025.04); evidence in release-watch/2026-10-28/run3/scrubbing. Co-Authored-By: Claude Opus 5.5 --- detect/synthetic-monitoring/api-checks/configuration.mdx | 6 ++++-- platform/secrets.mdx | 2 +- platform/variables.mdx | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/detect/synthetic-monitoring/api-checks/configuration.mdx b/detect/synthetic-monitoring/api-checks/configuration.mdx index 3fa64986..bfdfe30e 100644 --- a/detect/synthetic-monitoring/api-checks/configuration.mdx +++ b/detect/synthetic-monitoring/api-checks/configuration.mdx @@ -78,6 +78,8 @@ Add HTTP request headers. The type ahead feature is pre-populated with the most Clicking the **lock icon** toggles between encrypting the value of the header on the Checkly backend and hiding it from your screen. +The `Authorization`, `Proxy-Authorization`, `X-Api-Key`, `X-Auth-Token`, `Cookie` and `Set-Cookie` request and response headers are stored in the check result as `*********`, even when they contain no secret. + ## Query parameters This section allows you to add query parameters to the request URL in a structured way. You can add as many query parameters as you want. The interface is the same as for the HTTP headers: you can use the lock icon to toggle encryption and screen hiding. @@ -91,7 +93,7 @@ request by entering a username and password in the Authentication tab. ## Accessing environment variables -[Environment variables](/platform/variables) are exposed to your API checks using the common Handlebars/Moustache templating delimiters, i.e. `{{USER_API_KEY}}`. Note that Handlebars (double brackets) variables will be URI encoded. To avoid encoding, you can access your environment variables with triple brackets, i.e. `{{{USER_API_KEY}}}`. +[Environment variables](/platform/variables) are exposed to your API checks using the common Handlebars/Moustache templating delimiters, i.e. `{{USER_API_KEY}}`. Note that Handlebars (double brackets) variables will be URI encoded. To avoid encoding, you can access your environment variables with triple brackets, i.e. `{{{USER_API_KEY}}}`. A secret is scrubbed from the stored request URL, query parameters and response body in its URI-encoded spelling as well. Variables can be used in the following API checks fields: @@ -175,7 +177,7 @@ On each API check assertion, the following sources are available: - **Status code:** The HTTP response status, parsed as an integer. - **JSON body:** The response body parsed as a JSON object. To enable parsing, the Content-Type header of the response should be set to application/json. - **Text body:** The response body as plain text. -- **Headers:** The response headers as an array of key/value pairs. +- **Headers:** The response headers as an array of key/value pairs. An assertion on one of the headers listed under [Headers](#headers) compares the real value, but the result stores `*********` as the actual value and in the error message. - **Response time:** The response time of the full API request in milliseconds, parsed as an integer value. For more details, see our documentation on [Assertions](/detect/assertions). diff --git a/platform/secrets.mdx b/platform/secrets.mdx index f20a9be1..11d28826 100644 --- a/platform/secrets.mdx +++ b/platform/secrets.mdx @@ -8,7 +8,7 @@ canonical: 'https://www.checklyhq.com/docs/platform/secrets/' Secrets in Checkly are a specialized form of data designed specifically for sensitive information that needs to be kept secure while remaining accessible to your monitoring. Secrets allow you to store sensitive data for use in checks. Once saved, secrets are never shown in the UI or in logs. The secret value cannot be accessed via the CLI or API. -Secrets require runtime version 2024.09 or later, Private Location agent `3.3.4` or later and CLI `4.9.0` or later. A few values are never scrubbed from Playwright traces, videos and screenshots, even when saved as secrets. See [Environment variables and secrets](/platform/variables) for the version details and the full list of scrubbing exceptions. +Secrets require runtime version 2024.09 or later, Private Location agent `3.3.4` or later and CLI `4.9.0` or later. A few values are never scrubbed from API check results, Playwright traces, videos and screenshots, even when saved as secrets. See [Environment variables and secrets](/platform/variables) for the version details and the full list of scrubbing exceptions. Secrets handle the truly sensitive elements—API keys, passwords, authentication tokens, and any other information that could compromise security if exposed. diff --git a/platform/variables.mdx b/platform/variables.mdx index 5eb97e5a..cd8cd817 100644 --- a/platform/variables.mdx +++ b/platform/variables.mdx @@ -20,9 +20,9 @@ Secrets are fully supported starting with runtime version 2024.09 and later. For -To ensure the integrity of Playwright artifacts (traces, videos and screenshots), the following are not scrubbed, even when saved as secrets: The characters `/` and `*` and the full or partial match of `/artifact/`, `https://`, `http://`, `*********`, and `123`. +To ensure the integrity of Playwright artifacts (traces, videos and screenshots), the following are not scrubbed, even when saved as secrets: The characters `/` and `*` and the full or partial match of `/artifact/`, `https://`, `http://`, `*********`, and `123`. The same exceptions apply to API check results. Values of the keys `sha1`, `_sha1`, `pageref`, `downloadsPath`, `tracesDir`, `pageId` and any string that ends with `sha1` will not be scrubbed from the Playwright trace, but will be scrubbed from the general check result. -Numbers are not scrubbed from the Playwright trace, but from the general check result. +On runtime 2025.04 and later, a secret that appears as a number or as a field name in the Playwright trace is scrubbed. A secret written in a different letter case, for example upper-cased, is not scrubbed.