Use a password in a journey

A sign-in journey needs a real password. Declare the value as a secret. Yewo then replaces it with a mask in the text it stores, and in the text it sends to a model. Read step 4 for the one place a secret can still appear.

1. Put the value in .envCopy Anchor Link

You commit yewo.yaml, so a real password must not live there. Put it in .env, which Yewo loads at startup. Keep .env out of version control:

TEST_ACCOUNT_PASSWORD=the-real-password

2. Declare it in yewo.yamlCopy Anchor Link

Read the value with ${...}, then name it under secrets:

env:
  email: qa@example.com
  password: ${TEST_ACCOUNT_PASSWORD}

secrets:
  - password

Yewo stops before the run if TEST_ACCOUNT_PASSWORD is unset or empty, and the error names the variable.

3. Use it in the journeyCopy Anchor Link

Reference a declared value with {{ ... }}:

workflows:
  smoke:
    journeys:
      - id: sign_in
        name: Sign in
        journey: |
          Open the app. Sign in as {{ email }} with the password {{ password }}.
          Then open Settings.

Yewo also stops before the run if your journey text references a value you did not declare.

4. Check the reportCopy Anchor Link

Yewo types the real password into the app. Everywhere else it writes the masked form:

• Stored model calls show the mask, not the value.
• Yewo removes the value from captured device logs.

You cannot turn this off. allow_secret_exposure: true stops the run.

email is not in the secrets list, so it appears as written. Declare every value you do not want to read in a report.

Show the last four charactersCopy Anchor Link

Some screens show part of a value, such as a card number. A masked value then hides the part you need to check. Set redaction: last4 on that value:

env:
  card_number:
    value: ${TEST_CARD_NUMBER}
    secret: true
    redaction: last4

The report shows the last four characters and hides the rest. The default, redaction: hide, hides the whole value.

Stop Yewo from entering a valueCopy Anchor Link

To declare a value that Yewo must never type, mark it as refused:

env:
  admin_password:
    value: ${ADMIN_PASSWORD}
    secret: true
    refused: true