Cucumber JVM default formatters output step arguments with unredacted sensitive data

There is no formatter-agnostic configuration or annotation in Cucumber JVM that redacts sensitive values across all reports. The core formatters (pretty, JSON, HTML, JUnit) are designed to serialize step arguments, data tables, and scenario outline examples exactly as they appear in the Gherkin source. Because this serialization happens at the parser/event level, masking values within a ParameterType or a step definition does not retroactively update the report payloads.

Why Masking Fails

When Cucumber executes a scenario, it emits events containing the raw arguments. If you have a step like Given I login with password "secret123", the formatter captures the string "secret123" immediately. Even if your Java code wraps this string in a custom object with a masked toString() method, the report-generated JSON or HTML file will still contain the original literal.

The Maintainable Pattern: Indirection

The most effective way to prevent credential exposure without writing custom formatters is to use indirection. Instead of placing secrets in .feature files, use symbolic keys or aliases that are resolved at runtime.

• Feature File: Use a placeholder like Given I authenticate with token "API_KEY_ENV".
• Step Definition: Use the alias to fetch the actual secret from an environment variable, a secrets manager, or a configuration vault.

@Given("I authenticate with token {string}")
public void authenticate(String tokenAlias) {
    // The secret is fetched at runtime, never stored in the report
    String actualSecret = System.getenv(tokenAlias); 
    authService.login(actualSecret);
}

Handling Data Tables and Outlines

The same logic applies to Data Tables and Scenario Outlines. Avoid hardcoding credentials in Examples rows. Use a lookup key and resolve the value within the step logic to ensure the build artifacts only contain the key name.

Verification

To verify your protection is working, run a test with a dummy secret and grep the output artifacts:

grep -r "your-dummy-secret" target/cucumber-report/

If the command returns results, the secret is still leaking into your report files.