Cucumber JVM default formatters output step arguments with unredacted sensitive data

Cucumber JVM's default formatters (pretty, json, html, JUnit) serialize step arguments, data-table cells, and scenario-outline examples verbatim into report output, including any embedded credentials, tokens, or secrets. The core runtime provides no automatic detection or masking of sensitive values, and no first-party configuration flag exists as of Cucumber 8.x to redact them across all formatter targets.

Custom ParameterType transformers may mask step-level text output, but their effect does not consistently propagate to JSON report payloads or HTML report bodies, leaving persistent secrets in build artifacts. Third-party formatters and reporting plugins offer varying levels of support, and behavior depends on formatter implementation rather than a unified Cucumber policy.

Is there a formatter-agnostic configuration or annotation in Cucumber JVM that can reliably obscure sensitive values across all report formats? If not, what is the minimal, maintainable pattern to prevent credential exposure in JSON and HTML reports without custom formatter development? How do Cucumber reporting roadmaps address the absence of built-in secret redaction?