From 5240de810099ddd53d7540caed45cf11bc94108c Mon Sep 17 00:00:00 2001
From: nicktrn <55853254+nicktrn@users.noreply.github.com>
Date: Thu, 4 Jun 2026 19:34:03 +0100
Subject: [PATCH] fix(supervisor): strip backpressure redis password from debug
 env log

Add TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD to the secret strip-list so it
never lands in the DEBUG startup log, with a comment to keep new secrets out.
---
 apps/supervisor/src/index.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/supervisor/src/index.ts b/apps/supervisor/src/index.ts
index 0f913b2aa..4eb4cf406 100644
--- a/apps/supervisor/src/index.ts
+++ b/apps/supervisor/src/index.ts
@@ -72,10 +72,13 @@ class ManagedSupervisor {
   private readonly wideEventsNoisyRoutes = env.TRIGGER_WIDE_EVENTS_NOISY_ROUTES;
 
   constructor() {
+    // Strip secret-like env vars before debug-logging the rest. Add any new
+    // secret env var here so it never lands in the DEBUG "Starting up" log.
     const {
       TRIGGER_WORKER_TOKEN,
       MANAGED_WORKER_SECRET,
       COMPUTE_GATEWAY_AUTH_TOKEN,
+      TRIGGER_DEQUEUE_BACKPRESSURE_REDIS_PASSWORD,
       ...envWithoutSecrets
     } = env;