Category: feature — Breaking: no
Masking requires [SecretValue] per property on IOptions classes (docs/docs/how-to/secrets.md, Engine/ISecretProvider.cs) or runtime ISecretRegistry.AddSecret. Values pulled in via Key Vault/user-secrets configuration providers are logged unmasked unless every property is attributed — there is no "everything under Secrets: is secret" declaration. (#3113/#3172 fixed masking mechanics, not registration ergonomics.)
Proposal: SecretMaskingOptions.MaskedConfigurationSections = ["Secrets", "ConnectionStrings"] plus builder.MaskConfigurationSection("Secrets") sugar: at startup, enumerate the section's leaf values into the existing ISecretRegistry, which already propagates to CI-native masking. Roughly a 30-line feature on existing infrastructure; makes any generic-host secret provider safe by default. Perf: startup-only enumeration.
Part of #3239 (round 2).
Category: feature — Breaking: no
Masking requires
[SecretValue]per property on IOptions classes (docs/docs/how-to/secrets.md,Engine/ISecretProvider.cs) or runtimeISecretRegistry.AddSecret. Values pulled in via Key Vault/user-secrets configuration providers are logged unmasked unless every property is attributed — there is no "everything underSecrets:is secret" declaration. (#3113/#3172 fixed masking mechanics, not registration ergonomics.)Proposal:
SecretMaskingOptions.MaskedConfigurationSections = ["Secrets", "ConnectionStrings"]plusbuilder.MaskConfigurationSection("Secrets")sugar: at startup, enumerate the section's leaf values into the existing ISecretRegistry, which already propagates to CI-native masking. Roughly a 30-line feature on existing infrastructure; makes any generic-host secret provider safe by default. Perf: startup-only enumeration.Part of #3239 (round 2).