S
Standard Opossum
Currently, when using a custom secret manager, Harness supports reading secrets but does not provide a native capability to update secrets directly within a custom secret store. To address this limitation, we are exploring the use of a pipeline that accepts user-provided input and updates secret values in the external secret store.
However, there is currently no option to designate a runtime input field as a secure or masked field (similar to an HTML password field). As a result, sensitive values entered by users are displayed in plain text during input, creating usability and security concerns.
Requested Enhancement:
Introduce a capability to mark runtime input fields as secure/password fields, with the following behavior:
  • Mask user-entered values during input and execution.
  • Prevent sensitive values from being displayed in logs, UI screens, or execution details.
  • Allow temporary or short-lived credentials (tokens, passwords, API keys, etc.) to be provided securely at runtime without requiring them to be pre-created and stored as Harness secrets.
  • Support use cases where pipelines update external/custom secret stores based on user-supplied secret values.