From dc2335547d2d95eec29d0b856763c6604fa5a6b3 Mon Sep 17 00:00:00 2001
From: "aspire-repo-bot[bot]"
 <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
Date: Fri, 14 Aug 2026 17:22:40 +0000
Subject: [PATCH 1/2] docs: note secret redaction in aspire describe output

Documents changes from microsoft/aspire#19248
---
 .../content/docs/reference/cli/commands/aspire-describe.mdx   | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
index f69661334..9321aaf32 100644
--- a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
+++ b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
@@ -37,6 +37,10 @@ When executed without the `--apphost` option, the command:
 The `aspire resources` command is a backward-compatible alias for `aspire describe`. Both names invoke the same command.
 </Aside>
 
+<Aside type="note">
+Secret values—such as passwords generated for resources like PostgreSQL, Redis, or SQL Server—are redacted from the output. Redaction applies to every resource that references the secret, including the resource that owns it, so a generated password never appears in plaintext in an environment variable such as `POSTGRES_PASSWORD`.
+</Aside>
+
 ## Arguments
 
 - **`<resource>`**

From b67404ef4e5c9085db00d7bcdda9b14b525cf889 Mon Sep 17 00:00:00 2001
From: David Pine <david.pine@microsoft.com>
Date: Tue, 18 Aug 2026 08:12:55 -0500
Subject: [PATCH 2/2] Apply suggestions from code review

Co-authored-by: David Pine <david.pine@microsoft.com>
---
 .../src/content/docs/reference/cli/commands/aspire-describe.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
index 9321aaf32..f7059be32 100644
--- a/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
+++ b/src/frontend/src/content/docs/reference/cli/commands/aspire-describe.mdx
@@ -38,7 +38,7 @@ The `aspire resources` command is a backward-compatible alias for `aspire descri
 </Aside>
 
 <Aside type="note">
-Secret values—such as passwords generated for resources like PostgreSQL, Redis, or SQL Server—are redacted from the output. Redaction applies to every resource that references the secret, including the resource that owns it, so a generated password never appears in plaintext in an environment variable such as `POSTGRES_PASSWORD`.
+Environment-variable values that exactly match a resolved secret parameter—such as a generated PostgreSQL, Redis, or SQL Server password—are redacted from every referencing resource. Secrets embedded within larger values, such as connection strings, are not redacted.
 </Aside>
 
 ## Arguments