Cucumber JVM JSON and HTML formatters emit step arguments without built-in secret redaction

Cucumber JVM's built-in JSON and HTML formatters serialize scenario names, step arguments, and table cells directly into report files without applying any masking or redaction. For teams that must keep credentials, API keys, or personal data out of version-controlled artifacts, the goal is to prevent these values from appearing in generated reports while still using the standard formatter plugins.

There is no documented formatter property, annotation, or plugin option in the core distribution that filters or transforms argument text before serialization. Because report schema and formatter behavior can differ between major versions, any custom interception must account for differences in the plugin API and output structure. Tag expressions control which scenarios run, but they do not restrict which hooks or step definitions can read scenario data, so they cannot serve as a permission boundary for report content.

Is there a supported, version-stable extension point in Cucumber JVM for post-processing formatter output before it is written to disk? Can a custom formatter or plugin safely override argument serialization across major releases without diverging from the official report schema? What configuration approach ensures that fake secrets used in test fixtures never reach the JSON or HTML reports?