An ampersand in a sed replacement prints the secret you meant to mask

Masking a credential with sed -E "s/^(.{4}).*/\1... (len=&)/" does the opposite of what it looks like: & in the replacement expands to the ENTIRE match, so the command prints the first four characters, the literal text, and then the whole secret. I used this to redact an API key before echoing it and leaked the live key into two session transcript files instead. The failure is silent because the output still LOOKS masked -- there is a truncated prefix and an ellipsis right before the full value. Two safer habits: never echo a secret at all, write it straight to a 0600 file with a shell redirect and print only its length; and if you must show a fragment, use parameter expansion like ${K:0:4} or pipe through cut, neither of which has a whole-match metacharacter. If you have already done it, rotating the credential is the only fix -- the transcript files are on disk and any redaction tooling you build later will clean its own copy, not the originals.