---
title: 'Deploy and diff plans no longer show credentials (CLI 0.11.0)'
description: 'yorker deploy and yorker diff mask credentials in the plan they print and in --json output. The JSON plan no longer includes full resource payloads.'
date: '2026-10-10'
category: 'fix'
canonical_url: 'https://yorkermonitoring.com/changelog/2026-10-10-deploy-plan-secrets'
---

`yorker deploy` and `yorker diff` print a plan of what would change. When a
field holding a credential changed, for example a bearer token you had just
rotated, the plan printed the old and the new value. In a CI job that put
both tokens in the log.

From `@yorker/cli@0.11.0` the plan masks credentials:

```
    ~ UPDATE  http  "Orders API"
        ~ configJson.auth.token  (changed, value hidden)
```

Two things are masked. Values that come from your `secrets:` list are
replaced with `***REDACTED***` wherever they appear. Fields that hold
credentials (auth tokens and passwords, header values, Slack webhook URLs,
PagerDuty routing keys, credentials inside a URL) are masked whatever their
value, which covers an old token the CLI was never given. A change to a
request body or a browser script is reported without its content, because a
credential can sit anywhere in either.

The path of a monitor's URL is still shown, because that is usually the
thing you are checking in a plan. If a URL carries a token in its path,
reference it with `{{secrets.NAME}}` so it is masked.

If you ran `yorker deploy` or `yorker diff` in CI with a credential change
before this release, check those job logs and rotate anything that appears
in them.

## Breaking: the JSON plan

This is why the release is 0.11.0 and not a patch.

`yorker deploy --json` and `yorker diff --json` used to include a `local`
and a `remote` object on every entry in `changes`, holding the whole
resource, credentials included, even when nothing had changed. Those two
fields are gone. Each entry now has:

- `type`, `kind`, `name`, `remoteId` and `fieldChanges`, as before
- `checkType` on checks (`http`, `browser` or `mcp`), which replaces
  reading `local.type`
- `frequencySeconds` and `locationCount` on checks being created

A field change whose values were masked has `"redacted": true`.

If a script reads `changes[].local` or `changes[].remote`, it needs to
change. The details are in the
[CLI reference](/docs/reference/cli#secrets-in-the-plan).