Passwords in env variables should be hidden on debug page like other settings are.

[galt]

Hundreds of blog pages tell people to put their settings for database and other passwords and keys
into env variables for easier management, and then settings.py reads those. This is often described as a good way to avoid accidentally checking sensitive settings.py into source code control like git. But then the env variables are exposed in the django debug output with debug=true. Since django already hides 'API|TOKEN|KEY|SECRET|PASS|SIGNATURE' for django settings, it should hide env variables too in the same way.

Currently this problem is not easy to work around.

Having debug=false for production helps protect production servers. But some users use the same db user/password for both development and production systems. So leaking one leaks the other.

On rare occasions, people need to temporarily enable debug on production to solve some quick issue. So fixing the bug would make this safer.

[Tim Graham]

I'm guessing you aren't using Django 3.1 which has #23004, but if you are please elaborate on where you see this.