Repository navigation
describe constant and show constants print a stored default value, which can be a credential #1524
Description
Summary
describe constant and show constants print the stored default value, which can be a credential. In agent-driven sessions this lands the secret in the transcript. Security-flavoured. Existing mitigation: mxcli constant set (v0.25) keeps secrets out of the model. #801 (closed) is unrelated.
Repro
create constant M.ApiPassword ( Type: String, DefaultValue: 'example-value' );mxcli -p app.mpr -c "describe constant M.ApiPassword"and-c "show constants in M".
Expected
Values of constants whose name matches Password, Secret or Token (or constants marked private) are masked; a --reveal flag prints them.
Actual
The literal default is printed. The v0.27.0 source has no masking or reveal flag.
Tested with: Mendix 11.15.0, mxcli v0.26.0 on macOS; v0.27.0 source searched, not run.
Activity
github-actions commentedon Oct 16, 2026
Issue Triage
Summary:
The
describe constantandshow constantscommands expose constant default values (including possible secrets) in the CLI output, which could be captured in agent‑driven session transcripts.Checklist (bug report)
mxcli -p app.mpr -c "describe constant M.ApiPassword"andshow constants in M--revealflag to show themmxcli diag --bundle)Missing information:
To help us investigate, could you please provide the session log or the output of
mxcli diag --bundlefor the commands you ran? This will give us the exact context needed to reproduce and fix the issue.Thank you for reporting this!
Automated triage via OpenRouter — workflow source