diff --git a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
index f69661334..f7059be32 100644
--- a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
+++ b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
@@ -37,6 +37,10 @@ When executed without the `--apphost` option, the command:
 The `aspire resources` command is a backward-compatible alias for `aspire describe`. Both names invoke the same command.
 </Aside>
 
+<Aside type="note">
+Environment-variable values that exactly match a resolved secret parameter—such as a generated PostgreSQL, Redis, or SQL Server password—are redacted from every referencing resource. Secrets embedded within larger values, such as connection strings, are not redacted.
+</Aside>
+
 ## Arguments
 
 - **`<resource>`**