docs: secret scrubbing in API check results and Playwright traces (product update 2026-10-28)

detect/synthetic-monitoring/api-checks/configuration.mdx

@@ -78,6 +78,8 @@ Add HTTP request headers. The type ahead feature is pre-populated with the most
 
 Clicking the **lock icon** toggles between encrypting the value of the header on the Checkly backend and hiding it from your screen.
 
+The `Authorization`, `Proxy-Authorization`, `X-Api-Key`, `X-Auth-Token`, `Cookie` and `Set-Cookie` request and response headers are stored in the check result as `*********`, even when they contain no secret.
+
 ## Query parameters
 
 This section allows you to add query parameters to the request URL in a structured way. You can add as many query parameters as you want. The interface is the same as for the HTTP headers: you can use the lock icon to toggle encryption and screen hiding.
@@ -91,7 +93,7 @@ request by entering a username and password in the Authentication tab.
 
 ## Accessing environment variables
 
-[Environment variables](/platform/variables) are exposed to your API checks using the common Handlebars/Moustache templating delimiters, i.e. `{{USER_API_KEY}}`. Note that Handlebars (double brackets) variables will be URI encoded. To avoid encoding, you can access your environment variables with triple brackets, i.e. `{{{USER_API_KEY}}}`.
+[Environment variables](/platform/variables) are exposed to your API checks using the common Handlebars/Moustache templating delimiters, i.e. `{{USER_API_KEY}}`. Note that Handlebars (double brackets) variables will be URI encoded. To avoid encoding, you can access your environment variables with triple brackets, i.e. `{{{USER_API_KEY}}}`. A secret is scrubbed from the stored request URL, query parameters and response body in its URI-encoded spelling as well.
 
 Variables can be used in the following API checks fields:
 
@@ -175,7 +177,7 @@ On each API check assertion, the following sources are available:
 - **Status code:** The HTTP response status, parsed as an integer.
 - **JSON body:** The response body parsed as a JSON object. To enable parsing, the Content-Type header of the response should be set to application/json.
 - **Text body:** The response body as plain text.
-- **Headers:** The response headers as an array of key/value pairs.
+- **Headers:** The response headers as an array of key/value pairs. An assertion on one of the headers listed under [Headers](#headers) compares the real value, but the result stores `*********` as the actual value and in the error message.
 - **Response time:** The response time of the full API request in milliseconds, parsed as an integer value.
 
 For more details, see our documentation on [Assertions](/detect/assertions).

platform/secrets.mdx

@@ -8,7 +8,7 @@ canonical: 'https://www.checklyhq.com/docs/platform/secrets/'
 Secrets in Checkly are a specialized form of data designed specifically for sensitive information that needs to be kept secure while remaining accessible to your monitoring. Secrets allow you to store sensitive data for use in checks. Once saved, secrets are never shown in the UI or in logs. The secret value cannot be accessed via the CLI or API.
 
 <Note>
-Secrets require runtime version 2024.09 or later, Private Location agent `3.3.4` or later and CLI `4.9.0` or later. A few values are never scrubbed from Playwright traces, videos and screenshots, even when saved as secrets. See [Environment variables and secrets](/platform/variables) for the version details and the full list of scrubbing exceptions.
+Secrets require runtime version 2024.09 or later, Private Location agent `3.3.4` or later and CLI `4.9.0` or later. A few values are never scrubbed from API check results, Playwright traces, videos and screenshots, even when saved as secrets. See [Environment variables and secrets](/platform/variables) for the version details and the full list of scrubbing exceptions.
 </Note>
 
 Secrets handle the truly sensitive elements—API keys, passwords, authentication tokens, and any other information that could compromise security if exposed.

platform/variables.mdx

@@ -20,9 +20,9 @@ Secrets are fully supported starting with runtime version 2024.09 and later. For
 </Note>
 
 <Warning>
-To ensure the integrity of Playwright artifacts (traces, videos and screenshots), the following are not scrubbed, even when saved as secrets: The characters `/` and `*` and the full or partial match of `/artifact/`, `https://`, `http://`, `*********`, and `123`.
+To ensure the integrity of Playwright artifacts (traces, videos and screenshots), the following are not scrubbed, even when saved as secrets: The characters `/` and `*` and the full or partial match of `/artifact/`, `https://`, `http://`, `*********`, and `123`. The same exceptions apply to API check results.
 Values of the keys `sha1`, `_sha1`, `pageref`, `downloadsPath`, `tracesDir`, `pageId` and any string that ends with `sha1` will not be scrubbed from the Playwright trace, but will be scrubbed from the general check result.
-Numbers are not scrubbed from the Playwright trace, but from the general check result.
+On runtime 2025.04 and later, a secret that appears as a number or as a field name in the Playwright trace is scrubbed. A secret written in a different letter case, for example upper-cased, is not scrubbed.
 </Warning>
 
 <Tip>