GitLab CI/CD masked variable coverage for Base64-encoded job output

GitLab CI/CD variables marked as Masked are hidden from job logs through a string-replacement mechanism that targets the exact stored value. When a job script transforms that value—for example, piping a secret through base64 or embedding it in a JSON payload—the transformed representation no longer matches the original variable string and can appear in plain text in the job log.

This behavior is separate from the Protected flag, which controls branch and tag availability rather than log visibility. Masking rules also impose character and length constraints on the stored value itself, but they do not address derived or encoded forms produced during pipeline execution.

For pipelines that log encoded artifacts or configuration snippets containing sensitive material, the exact-match replacement model leaves a gap between the stored secret and its runtime transformations. Is there a documented configuration to extend masking to transformed representations of a variable, or is exact-string matching the only supported behavior for Masked CI/CD variables?