Multi-line secrets are not redacted when "Running Command:"

[tonglil]

Drone GAE Plugin built from 1e5e603cf8fe827a2ee0f1aced22361f00d6a714
Running Command: /google-cloud-sdk/bin/gcloud auth activate-service-account --key-file /tmp/gcloud.json
Activated service account credentials for: [xxx@yyy.iam.gserviceaccount.com]
Running Command: /go_appengine/appcfg.py  --oauth2_access_token  [redacted] 
-A yyy -V zzz -E API_KEY: [redacted] -E CREDENTIALS: [redacted] "type": "service_account", "project_id": "xyz", "private...

[almadireddy]

Is there a project somewhere I can look at for reference that has this issue?

[jprobinson]

The easiest way to reproduce this problem within Drone itself would be to add a multi-line string in the 'ae_environment' drone plugin config and then use action: update with a Go 1.9 GAE application.

Go 1.11+ apps use action: deploy, which will not attempt to pass variables via the -E and potentially expose them.