DB_PASS slips past the five keywords Spring Boot's env sanitizer matches on

Nothing in the default path looks at the value itself, only at the key carrying it. A token stored under INTERNAL_CIPHER is printed exactly as stored. The rule is a name test: password, secret, key, token or credentials in the key, and the value comes back as six asterisks ^[1][2]. Running Vault or AWS Secrets Manager in production does not change that, because the case the post describes is a staging YAML file that still holds the literal names ^[10].

The post's own counterexample works against it. THIRD_PARTY_SHARED_SECRET_VALUE contains the string "secret", so under the contains-rule the post itself describes, that value is already masked ^[14]. The post hedges, saying the default matcher may be stricter than a plain substring check for "secret" ^[10], and it names no version where that is true.

That gap runs through the piece. The author writes that SanitizingFunction replaced the keyword-based Sanitizer "in more recent versions of the framework" and stops there ^[6]. The keyword list, the management.endpoint.env.show-values property and the lambda signature all belong to specific releases. The snippet reads the key with data.getSanitizableData().getKey(), so the lambda parameter in that version is a wrapper, not the SanitizableData itself ^[13]. The post also never states what show-values defaults to, so how much of /actuator/env a fresh install returns to a curl is not established here ^[20].

The proposed pattern is (?i).*(pass|auth|signing|shared|cipher).* ^[11]. Five alternatives, five example names, one each: pass for DB_PASS, auth for API_AUTH, signing for WEBHOOK_SIGNING, shared for PARTNER_SHARED_VALUE, cipher for INTERNAL_CIPHER ^[15]. It closes exactly the holes the author had already written down. It also matches in the other direction, on any key containing "pass", so a BYPASS_CACHE flag comes back as asterisks too ^[17]. That is harmless right up to the afternoon someone is debugging why the cache is off.

"The default sanitizer covers the obvious names, but that's not where the real leaks happen," the author wrote ^[3]. The same argument went up twice on dev.to under the same author path, and the Spanish version words the thesis differently ^[5][18].

This transfers to your deployment only if the endpoint is reachable by a role you do not fully trust, and show-values is configured to expose values to that role ^[8]. It also takes one more condition: at least one secret in your config sits under a key that misses all five default words ^[16]. The first two are config lines you can read in a minute. The third is a list only your team has, and the post's answer is that the catalog of what to sanitize belongs to whoever configures the project ^[19].