Redact admin passwords from default studio list JSON - #4730

📊 Performance Test Results

Comparing 6dfdc00 vs trunk

app-size

site-editor

site-startup

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

Hi @chubes4 ! I merged trunk in, confirmed build works fine, and tested it. The main fix is correct and I verified it works.

Would you mind checking those?

1. The AI assistant can no longer find passwords, but still thinks it can.

Studio's built-in AI assistant reads that same output. So it lost access to passwords too. That's fine on its own — but three places in the code still tell the assistant "this command gives you credentials." So if you ask it "what's my admin password?", it confidently runs the command, gets nothing, and either gives up or makes one up.

Worse: there's no backup route. The PR says "use studio config get admin-password instead," but the assistant has no such tool. It's a dead end.

Fix: edit those three sentences to stop promising credentials.

2. A different command still leaks the password.

studio config get --format json prints the password in plain text. The PR didn't touch it — but the PR's own docs list that command alongside the fixed ones and say they all hide secrets. So someone reads the docs, trusts it, pipes it to a log file, and leaks the password anyway. Exactly the problem this PR set out to solve.

Fix: either patch that command too, or correct the sentence.

3. The filter blocks three specific names, not "secrets" generally.

The code removes three fields by name. The PR describes this as removing "any extra secret fields" — it doesn't. If someone adds a new secret field later, it gets printed until a person remembers to add it to the list.

Safer approach: instead of listing what to hide, list what to show. Then anything new is hidden by default.

Minor: two of the three names on the list (tlsKey, tlsCert) aren't stored in this file at all, so they never do anything. Harmless, just noise.

4. Two small notes

• The code converts the same data to text twice in a row. Costs nothing, just slightly untidy.
• The PR quietly fixed a second leak nobody mentioned: when a command crashes, Studio sends the error report to its crash-tracking service — and that report used to include the passwords. Now it doesn't. Worth putting in the description; it makes the PR look better than it currently does.