mise set doesn't redact secrets!

[deiga]

In my global mise config I have the following:

[env]
MISE_GITHUB_TOKEN = { value = "FOO", redact = true }

When running mise set it shows the value of MISE_GITHUB_TOKEN instead of redacting it:

$ mise set
key                                                value                                                                   source                                                    
MISE_GITHUB_TOKEN                                  FOO                                ~/.config/mise/config.toml             

$ mise doctor
version: 2025.6.5 macos-arm64 (2025-06-16)
activated: yes
shims_on_path: no

build_info:
  Target: aarch64-apple-darwin
  Features: DEFAULT, NATIVE_TLS, SELF_UPDATE
  Built: Mon, 16 Jun 2025 22:24:21 +0000
  Rust Version: rustc 1.87.0 (17067e9ac 2025-05-09) (Homebrew)
  Profile: release

shell:
  /bin/zsh
  zsh 5.9 (arm64-apple-darwin24.0)

dirs:
  cache: ~/Library/Caches/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  ~/.config/mise/config.toml

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  core
  dotnet
  gem
  go
  npm
  pipx
  spm
  ubi
  vfox

plugins:
  pipx  https://github.com/mise-plugins/mise-pipx.git#31db618
  yarn  https://github.com/mise-plugins/mise-yarn.git#5a1cb27

toolset:
  aqua:astral-sh/[email protected]
  aqua:hashicorp/[email protected]
  asdf:[email protected]
  core:[email protected]
  core:[email protected]
  ubi:jdx/[email protected]

path:
  ~/.local/share/mise/installs/node/23.11.1/bin
  ~/.local/share/mise/installs/pipx/1.7.1/bin
  ~/.local/share/mise/installs/python/3.12.10/bin
  ~/.local/share/mise/installs/terraform/1.9.5
  ~/.local/share/mise/installs/usage/2.1.1
  ~/.local/share/mise/installs/uv/0.7.9/uv-aarch64-apple-darwin
  ~/.bun/bin
  ~/Library/Caches/antidote/https-COLON--SLASH--SLASH-github.com-SLASH-laggardkernel-SLASH-git-ignore/bin
  /opt/homebrew/bin
  /opt/homebrew/sbin
  /opt/homebrew/opt/coreutils/libexec/gnubin
  ~/.poetry/bin
  ~/.cabal/bin
  ~/.local/bin/
  ~/bin
  ~/local/bin
  ~/go/bin
  /opt/homebrew/opt/curl/bin
  ~/.krew/bin
  /usr/local/bin
  /System/Cryptexes/App/usr/bin
  /usr/bin
  /bin
  /usr/sbin
  /sbin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin
  /Library/Apple/usr/bin
  /Applications/Privileges.app/Contents/MacOS
  /Applications/Wireshark.app/Contents/MacOS
  ~/Library/Caches/antidote/https-COLON--SLASH--SLASH-github.com-SLASH-reegnz-SLASH-jq-zsh-plugin/bin
  ~/Library/Caches/antidote/https-COLON--SLASH--SLASH-github.com-SLASH-droctothorpe-SLASH-kubecolor/bin
  ~/Library/Application Support/Code/User/globalStorage/github.copilot-chat/debugCommand

env_vars:
  MISE_SHELL=zsh
  MISE_GITHUB_TOKEN=REDACTED

settings:
  experimental                           true     ~/.config/mise/config.toml
  idiomatic_version_file_enable_tools    []       ~/.config/mise/config.toml
  jobs                                   4        ~/.config/mise/config.toml
  plugin_autoupdate_last_check_duration  "1 week" ~/.config/mise/config.toml

No problems found

[syrm]

Same problem

[rlperez]

Same problem as well. Redact isn't redacting anything. Not sure if its since the commit that was supposed to fix redacting too much or not. I thought this worked at one point though.

[jdx]

redaction was intended for log messages so this isn't a bug but I agree that it probably should redact here unless a flag is passed

[jorhett]

It does work as documented fwiw and does the purpose of masking it in the logs. Let's test:

[env]
MISE_GITHUB_TOKEN = { value = "FOO", redact = true }

[tasks.test-output]
run = "echo $MISE_GITHUB_TOKEN"

Here's an example output:

$ mise run test-output
[test-output] $ echo $MISE_GITHUB_TOKEN
[redacted]

It's not really hiding it, however, since the env command won't be redacted in any form.

$ mise en
$ env |grep TOKEN
MISE_GITHUB_TOKEN=FOO

...but I do agree that redacting it in mise env would at least help people confirm. One benefit of this would be to allow someone to run mise env for job output and not have those values shown. And given that you do have the --redacted option already implemented, nobody loses access to anything (they can't grab with the extra option).

[rlperez]

Guess I misread the functionality. My intuition on a feature like this would be that it would mask on any output of a command from mise. Though, I did not take the time to even see what mise env is doing. Of course, system env would not mask it as it doesn't have context to know its a sensitive value. Perhaps though, tasks are where this would be most important as its what you likely would do in say, a pipeline, and not want it in your logs.

Masking it in mise env may not even make sense if you wanted to see it to determine whether you have a correct value but my instincts on that is to use the system env command.