Command lines are redacted on the host before they are sent. The redaction works on shape — assignment syntax, credential-bearing flags, embedded URL credentials, long opaque tokens — rather than on a list of known key names, because a list only ever covers the names someone remembered to add.