Secrets & redaction

When you export, DriftSync detects secrets — API keys, passwords, tokens — and known environment URLs, and holds them back rather than blanking them out. A bundle stays safe to share and store, and a staging key can never overwrite a production one.

Held, not blanked#

This is the key distinction. A blanked value is an empty string — apply it and you wipe the target's real secret. A held value is different: the bundle records only that a value exists and was withheld, never the value itself. On apply, a held field is left exactly as the target already has it.

• The source site keeps its real value — redaction never destroys anything on export.
• The bundle carries no secret, so it is safe to commit, email, or attach to a ticket.
• The target keeps its own value. A held row in the dry-run diff shows a change is possible without leaking what it is.

Redaction presets#

Pick how aggressive redaction is at export time. There are four presets:

• none — hold nothing. Only sensible for bundles that never leave a trusted environment.
• secrets — hold values that look like keys, passwords, and tokens.
• secrets + URLs — also hold known environment URLs (site URL, home URL, and similar), so you do not promote a staging domain onto production.
• strict — the most cautious preset: hold secrets, URLs, and anything else that matches DriftSync's sensitive-value heuristics.

How a held value appears#

In the bundle, a held field is a small marker instead of a value — enough to drive the diff, with nothing sensitive inside:

{
	"driftsync": "1",
	"redaction": "secrets-urls",
	"values": {
		"blogname": "Acme",
		"smtp_host": "smtp.acme.com",
		"smtp_password": { "held": true, "reason": "secret" },
		"mailchimp_api_key": { "held": true, "reason": "secret" },
		"siteurl": { "held": true, "reason": "url" }
	}
}

Per-value override#

Presets are a starting point, not a cage. On the export screen you can override any individual field — force-hold something the preset missed, or explicitly include a value the preset held because you know the bundle is going somewhere trusted. The override applies to that one field, so the rest of the preset still protects everything else.

On the target#

After applying a bundle with held values, fill the real secrets in on the target as you normally would — the held fields are left untouched for exactly that. This is why promoting config from staging never clobbers a production API key: DriftSync had nothing to write there in the first place.