Every Plain setting ending in TOKEN, KEY, SECRET, PASSWORD or USER is now Secret[...] and masked, or says PUBLIC in its name.

A test enforces it across every package. First catch: EMAIL_HOST_USER. Postmark uses your API token as the SMTP username.