diff --git a/container_app_conf/entry/__init__.py b/container_app_conf/entry/__init__.py
index c892a15..6f8c63a 100644
--- a/container_app_conf/entry/__init__.py
+++ b/container_app_conf/entry/__init__.py
@@ -29,7 +29,7 @@ class ConfigEntry:
     _example = None
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None):
+                 required: bool = None, secret: bool = None):
         """
         Creates a config entry
         :param key_path: list of strings representing f.ex. the yaml tree path
@@ -37,7 +37,9 @@ class ConfigEntry:
         :param description: a description of this entry
         :param default: the default value
         :param required: Set to True if a 'None' value may be allowed, False if not,
-                             otherwise it will be True if the default value is not None.
+                            otherwise it will be True if the default value is not None.
+        :param secret: indicates whether this entry contains a secret and should be disguised when
+                        outputting the current configuration
         """
         if len(key_path) <= 0:
             raise ValueError("{}: key_path must contain at least one node".format(self.__class__.__name__))
@@ -56,6 +58,8 @@ class ConfigEntry:
             required = default is not None
         self._required = required
 
+        self.secret = False if secret is None else secret
+
         if default is not None:
             self.default = self._parse_value(default)
         else:
diff --git a/container_app_conf/entry/file.py b/container_app_conf/entry/file.py
index 6e3b957..199d74e 100644
--- a/container_app_conf/entry/file.py
+++ b/container_app_conf/entry/file.py
@@ -27,12 +27,12 @@ class FileConfigEntry(ConfigEntry):
     _example = "/tmp/temporary"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, check_existence: bool = False):
+                 required: bool = None, secret: bool = None, check_existence: bool = False):
         """
         See ConfigEntry
         :param check_existence: whether to check for file existence
         """
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
         self.check_existence = check_existence
 
     def _value_to_type(self, value: any) -> str or None:
diff --git a/container_app_conf/entry/float.py b/container_app_conf/entry/float.py
index 7a64e46..d04ff9c 100644
--- a/container_app_conf/entry/float.py
+++ b/container_app_conf/entry/float.py
@@ -26,9 +26,9 @@ class FloatConfigEntry(ConfigEntry):
     _example = "3.1415926535"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, range: Range = None):
+                 required: bool = None, secret: bool = None, range: Range = None):
         self.range = range
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> float or None:
         """
diff --git a/container_app_conf/entry/int.py b/container_app_conf/entry/int.py
index b08fca1..ad6648e 100644
--- a/container_app_conf/entry/int.py
+++ b/container_app_conf/entry/int.py
@@ -26,9 +26,9 @@ class IntConfigEntry(ConfigEntry):
     _example = "42"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, range: Range = None):
+                 required: bool = None, secret: bool = None, range: Range = None):
         self.range = range
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> int or None:
         """
diff --git a/container_app_conf/entry/list.py b/container_app_conf/entry/list.py
index 1cd7d5a..8214a2c 100644
--- a/container_app_conf/entry/list.py
+++ b/container_app_conf/entry/list.py
@@ -29,7 +29,9 @@ class ListConfigEntry(ConfigEntry):
 
     def __init__(self, item_type: Type[ConfigEntry], key_path: [str], example: any = None,
                  description: str or None = None,
-                 default: any = None, required: bool = None,
+                 default: any = None,
+                 required: bool = None,
+                 secret: bool = None,
                  item_args: dict = None,
                  delimiter: str = None):
         """
@@ -52,7 +54,8 @@ class ListConfigEntry(ConfigEntry):
             description=description,
             example=example,
             default=default,
-            required=required
+            required=required,
+            secret=secret,
         )
 
     @property
diff --git a/container_app_conf/entry/regex.py b/container_app_conf/entry/regex.py
index 148b6d7..6f2bf41 100644
--- a/container_app_conf/entry/regex.py
+++ b/container_app_conf/entry/regex.py
@@ -33,12 +33,12 @@ class RegexConfigEntry(ConfigEntry):
     _example = r"^[a-zA-z0-9]*$"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, flags: int or None = None):
+                 required: bool = None, secret: bool = None, flags: int or None = None):
         """
         :param flags: Regex flags to mandate or None if no flag restrictions should be made
         """
         self.flags = flags | re.UNICODE if flags is not None else None
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> Pattern or None:
         if value is None and self._required:
diff --git a/container_app_conf/entry/string.py b/container_app_conf/entry/string.py
index 96b04b5..9c23ea5 100644
--- a/container_app_conf/entry/string.py
+++ b/container_app_conf/entry/string.py
@@ -26,9 +26,9 @@ class StringConfigEntry(ConfigEntry):
     _example = "text"
 
     def __init__(self, key_path: [str], example: any = None, description: str or None = None, default: any = None,
-                 required: bool = None, regex: str = None):
+                 required: bool = None, secret: bool = None, regex: str = None):
         self.regex = re.compile(regex) if regex is not None else None
-        super().__init__(key_path, example, description, default, required)
+        super().__init__(key_path, example, description, default, required, secret)
 
     def _value_to_type(self, value: any) -> str or None:
         """

Mark configuration options as "secret"
**Is your feature request related to a problem? Please describe.**
Outputting the current configuration can leak secrets.

**Describe the solution you'd like**
Allow developers to mark individual config entries as `secret`. This information needs to be used in #29 to replace the values of such entries with a placeholder when generating the output.

diff --git a/tests/secret_test.py b/tests/secret_test.py
new file mode 100644
index 0000000..824e504
--- /dev/null
+++ b/tests/secret_test.py
@@ -0,0 +1,32 @@
+#  Copyright (c) 2019 Markus Ressel
+#  .
+#  Permission is hereby granted, free of charge, to any person obtaining a copy
+#  of this software and associated documentation files (the "Software"), to deal
+#  in the Software without restriction, including without limitation the rights
+#  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+#  copies of the Software, and to permit persons to whom the Software is
+#  furnished to do so, subject to the following conditions:
+#  .
+#  The above copyright notice and this permission notice shall be included in all
+#  copies or substantial portions of the Software.
+#  .
+#  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+#  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+#  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+#  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+#  SOFTWARE.
+from container_app_conf.entry.string import StringConfigEntry
+from tests import EntryTestBase
+
+
+class SecretTest(EntryTestBase):
+
+    def test_secret_entry(self):
+        config_entry = StringConfigEntry(key_path=["string"], required=False)
+        self.assertFalse(config_entry.secret)
+        config_entry = StringConfigEntry(key_path=["string"], required=False, secret=False)
+        self.assertFalse(config_entry.secret)
+        config_entry = StringConfigEntry(key_path=["string"], required=False, secret=True)
+        self.assertTrue(config_entry.secret)

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest
apt-get update apt-get install -y gcc
3.7
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
certifi @ file:///croot/certifi_1671487769961/work/certifi
-e git+https://github.com/markusressel/container-app-conf.git@e584ef008c893ae3b915762b9089529c061fd7c3#egg=container_app_conf
exceptiongroup==1.2.2
importlib-metadata==6.7.0
iniconfig==2.0.0
packaging==24.0
pluggy==1.2.0
py-range-parse==1.0.5
pytest==7.4.4
python-dateutil==2.9.0.post0
pytimeparse==1.1.8
PyYAML==6.0.1
six==1.17.0
toml==0.10.2
tomli==2.0.1
typing_extensions==4.7.1
zipp==3.15.0

name: container-app-conf
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - exceptiongroup==1.2.2
      - importlib-metadata==6.7.0
      - iniconfig==2.0.0
      - packaging==24.0
      - pluggy==1.2.0
      - py-range-parse==1.0.5
      - pytest==7.4.4
      - python-dateutil==2.9.0.post0
      - pytimeparse==1.1.8
      - pyyaml==6.0.1
      - six==1.17.0
      - toml==0.10.2
      - tomli==2.0.1
      - typing-extensions==4.7.1
      - zipp==3.15.0
prefix: /opt/conda/envs/container-app-conf

tests/secret_test.py::SecretTest::test_secret_entry
container_app_conf/entry/__init__.py container_app_conf/entry/regex.py container_app_conf/entry/string.py container_app_conf/entry/float.py container_app_conf/entry/list.py container_app_conf/entry/file.py container_app_conf/entry/int.py
container_app_conf/entry/__init__.py container_app_conf/entry/regex.py container_app_conf/entry/string.py container_app_conf/entry/float.py container_app_conf/entry/list.py container_app_conf/entry/file.py container_app_conf/entry/int.py