@@ -6,7 +6,7 @@
 
 use clap::Subcommand;
 use xearthlayer::config::{
-    analyze_config, config_file_path, upgrade_config, ConfigFile, ConfigKey,
+    analyze_config, config_file_path, upgrade_config, ConfigFile, ConfigKey, SENSITIVE_VALUE_MASK,
 };
 
 use crate::error::CliError;
@@ -120,14 +120,22 @@ fn run_list() -> Result<(), CliError> {
             current_section = section;
         }
 
-        let value = key.get(&config);
+        let raw_value = key.get(&config);
         let key_name = key.key_name();
 
-        if value.is_empty() {
-            println!("  {} = (not set)", key_name);
+        // Mask credentials so the output is safe to paste into bug
+        // reports. `(not set)` shows through unmasked because absence
+        // isn't a leak and is informative for users debugging
+        // "why isn't my Google provider working." See issue #162.
+        let display_value = if raw_value.is_empty() {
+            "(not set)".to_string()
+        } else if key.is_sensitive() {
+            SENSITIVE_VALUE_MASK.to_string()
         } else {
-            println!("  {} = {}", key_name, value);
-        }
+            raw_value
+        };
+
+        println!("  {} = {}", key_name, display_value);
     }
 
     Ok(())
 
@@ -11,6 +11,14 @@ use super::file::ConfigFile;
 use super::size::{format_size, parse_size};
 use crate::dds::DdsFormat;
 
+/// Display value used in place of any [`ConfigKey::is_sensitive`] value
+/// when the call site has no business showing the raw secret (notably
+/// `xearthlayer config list`, which is commonly pasted into bug reports).
+///
+/// Eight `x` characters: short enough to be obviously a placeholder, long
+/// enough that it can't be confused for a short real value.
+pub const SENSITIVE_VALUE_MASK: &str = "xxxxxxxx";
+
 /// Errors that can occur when getting or setting configuration values.
 #[derive(Debug, Error)]
 pub enum ConfigKeyError {
@@ -276,6 +284,22 @@ impl ConfigKey {
         self.name().split('.').nth(1).unwrap_or(self.name())
     }
 
+    /// Whether this key holds a credential or other secret that should
+    /// never be displayed verbatim in places that might end up in user
+    /// bug reports (notably `xearthlayer config list`).
+    ///
+    /// Per-call display sites should swap the value for
+    /// [`SENSITIVE_VALUE_MASK`] when this returns true. `config get` and
+    /// `config set` are intentionally NOT masked: they are authoritative
+    /// user actions, and masking them would prevent users from
+    /// inspecting or echoing back the value they just configured.
+    pub fn is_sensitive(&self) -> bool {
+        matches!(
+            self,
+            ConfigKey::ProviderGoogleApiKey | ConfigKey::ProviderMapboxAccessToken
+        )
+    }
+
     /// Get the value from a config file as a string.
     pub fn get(&self, config: &ConfigFile) -> String {
         match self {
@@ -1010,6 +1034,54 @@ mod tests {
         assert_eq!(ConfigKey::ProviderType.key_name(), "type");
     }
 
+    #[test]
+    fn is_sensitive_returns_true_for_provider_credentials() {
+        assert!(ConfigKey::ProviderGoogleApiKey.is_sensitive());
+        assert!(ConfigKey::ProviderMapboxAccessToken.is_sensitive());
+    }
+
+    #[test]
+    fn is_sensitive_returns_false_for_non_credential_keys() {
+        // Spot-check across sections — anything that isn't a credential
+        // must round-trip as non-sensitive so that masked output stays
+        // narrowly scoped.
+        assert!(!ConfigKey::GeneralUpdateCheck.is_sensitive());
+        assert!(!ConfigKey::ProviderType.is_sensitive());
+        assert!(!ConfigKey::CacheDirectory.is_sensitive());
+        assert!(!ConfigKey::PackagesLibraryUrl.is_sensitive());
+        assert!(!ConfigKey::LoggingFile.is_sensitive());
+        assert!(!ConfigKey::PrefetchEnabled.is_sensitive());
+    }
+
+    #[test]
+    fn is_sensitive_covers_every_key_exhaustively() {
+        // Guard against a future ConfigKey variant being added without
+        // a deliberate sensitivity decision: every key in `all()` must
+        // be classifiable, and the only `true` results allowed are the
+        // two known credentials.
+        let sensitive: Vec<ConfigKey> = ConfigKey::all()
+            .iter()
+            .copied()
+            .filter(|k| k.is_sensitive())
+            .collect();
+        assert_eq!(
+            sensitive,
+            vec![
+                ConfigKey::ProviderGoogleApiKey,
+                ConfigKey::ProviderMapboxAccessToken,
+            ]
+        );
+    }
+
+    #[test]
+    fn sensitive_value_mask_is_eight_x_chars() {
+        // The mask is treated as a constant by the CLI; if it changes,
+        // the change must be deliberate (and probably wants to update
+        // diagnostics redaction too).
+        assert_eq!(SENSITIVE_VALUE_MASK, "xxxxxxxx");
+        assert_eq!(SENSITIVE_VALUE_MASK.len(), 8);
+    }
+
     #[test]
     fn test_get_value() {
         let config = ConfigFile::default();
 
@@ -100,7 +100,7 @@ pub use file::{
     DEFAULT_RETRY_BASE_DELAY_MS,
     DEFAULT_WEB_API_PORT,
 };
-pub use keys::{ConfigKey, ConfigKeyError};
+pub use keys::{ConfigKey, ConfigKeyError, SENSITIVE_VALUE_MASK};
 pub use size::{format_size, parse_size, Size, SizeParseError};
 pub use storage::{
     DiskIoProfile, DEFAULT_CPU_FALLBACK, HDD_BLOCKING_CEILING, HDD_BLOCKING_SCALING_FACTOR,
 
@@ -378,32 +378,84 @@ impl ConfigInfo {
             info.config_path = Some(config_path.display().to_string());
 
             if let Ok(content) = fs::read_to_string(&config_path) {
-                let mut redacted = String::new();
-                for line in content.lines() {
-                    let trimmed = line.trim();
-                    if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with(';') {
-                        continue;
-                    }
-                    if trimmed.to_lowercase().contains("api_key")
-                        || trimmed.to_lowercase().contains("secret")
-                        || trimmed.to_lowercase().contains("token")
-                    {
-                        if let Some(key) = trimmed.split('=').next() {
-                            redacted.push_str(&format!("{} = [REDACTED]\n", key.trim()));
-                        }
-                    } else {
-                        redacted.push_str(line);
-                        redacted.push('\n');
-                    }
-                }
-                info.config_contents = Some(redacted);
+                info.config_contents = Some(redact_sensitive_ini(&content));
             }
         }
 
         info
     }
 }
 
+/// Track the current INI section while walking lines so we can construct
+/// `section.key` names and look them up via [`ConfigKey`].
+fn parse_section_header(line: &str) -> Option<&str> {
+    let trimmed = line.trim();
+    if trimmed.starts_with('[') && trimmed.ends_with(']') && trimmed.len() >= 2 {
+        Some(&trimmed[1..trimmed.len() - 1])
+    } else {
+        None
+    }
+}
+
+/// Redact sensitive credential values from raw INI text by checking each
+/// `key = value` line against [`ConfigKey::is_sensitive`] and substituting
+/// [`SENSITIVE_VALUE_MASK`] for the value.
+///
+/// Section headers, comments, blank lines, non-sensitive entries, and
+/// entries with empty values are preserved verbatim — empty values aren't
+/// secrets and the absence is informative when reading a diagnostics
+/// dump. See issue #162 for why we drive both this and `config list`
+/// from the same `is_sensitive` predicate.
+fn redact_sensitive_ini(content: &str) -> String {
+    use crate::config::{ConfigKey, SENSITIVE_VALUE_MASK};
+
+    let mut out = String::with_capacity(content.len());
+    let mut current_section: Option<String> = None;
+
+    for line in content.lines() {
+        if let Some(section) = parse_section_header(line) {
+            current_section = Some(section.to_string());
+            out.push_str(line);
+            out.push('\n');
+            continue;
+        }
+
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with(';') {
+            out.push_str(line);
+            out.push('\n');
+            continue;
+        }
+
+        let Some(eq_idx) = line.find('=') else {
+            out.push_str(line);
+            out.push('\n');
+            continue;
+        };
+
+        let key_part = line[..eq_idx].trim();
+        let value_part = line[eq_idx + 1..].trim();
+        let qualified = match &current_section {
+            Some(s) => format!("{}.{}", s, key_part),
+            None => key_part.to_string(),
+        };
+
+        let is_sensitive = qualified
+            .parse::<ConfigKey>()
+            .map(|k| k.is_sensitive())
+            .unwrap_or(false);
+
+        if is_sensitive && !value_part.is_empty() {
+            out.push_str(&format!("{} = {}\n", key_part, SENSITIVE_VALUE_MASK));
+        } else {
+            out.push_str(line);
+            out.push('\n');
+        }
+    }
+
+    out
+}
+
 impl fmt::Display for SystemReport {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         writeln!(f, "XEarthLayer Diagnostics")?;
@@ -687,4 +739,82 @@ mod tests {
             resolved.display()
         );
     }
+
+    #[test]
+    fn redact_sensitive_ini_masks_provider_credentials() {
+        let input = "\
+[provider]
+type = google
+google_api_key = AIzaTEST_KEY_NOT_REAL_xxxxxx
+mapbox_access_token = pk.eyJ1IjoidGVzdCJ9.fake
+";
+        let redacted = redact_sensitive_ini(input);
+        assert!(redacted.contains("type = google"));
+        assert!(redacted.contains("google_api_key = xxxxxxxx"));
+        assert!(redacted.contains("mapbox_access_token = xxxxxxxx"));
+        assert!(!redacted.contains("AIzaTEST"));
+        assert!(!redacted.contains("pk.eyJ1"));
+    }
+
+    #[test]
+    fn redact_sensitive_ini_preserves_empty_credential_values() {
+        // Empty values aren't secrets and the absence is informative
+        // when reading a diagnostics dump (e.g., "user hasn't set their
+        // Google key yet, that's why google provider isn't working").
+        let input = "[provider]\ngoogle_api_key =\n";
+        let redacted = redact_sensitive_ini(input);
+        assert!(
+            redacted.contains("google_api_key ="),
+            "empty value must pass through verbatim, got: {:?}",
+            redacted
+        );
+        assert!(!redacted.contains("xxxxxxxx"));
+    }
+
+    #[test]
+    fn redact_sensitive_ini_preserves_non_credentials_and_structure() {
+        let input = "\
+# top comment
+[cache]
+directory = /tmp/cache
+memory_size = 512MB
+
+; section comment
+[provider]
+type = bing
+";
+        let redacted = redact_sensitive_ini(input);
+        // Comments, headers, and non-sensitive values all preserved.
+        assert!(redacted.contains("# top comment"));
+        assert!(redacted.contains("[cache]"));
+        assert!(redacted.contains("directory = /tmp/cache"));
+        assert!(redacted.contains("memory_size = 512MB"));
+        assert!(redacted.contains("; section comment"));
+        assert!(redacted.contains("[provider]"));
+        assert!(redacted.contains("type = bing"));
+        assert!(!redacted.contains("xxxxxxxx"));
+    }
+
+    #[test]
+    fn redact_sensitive_ini_passes_through_unknown_keys() {
+        // Unknown keys (e.g., from a future XEL version, or user typos)
+        // pass through unchanged. The exhaustive `is_sensitive` test in
+        // config::keys guarantees we never miss a real sensitive variant.
+        let input = "[provider]\nfuture_unknown_key = some_value\n";
+        let redacted = redact_sensitive_ini(input);
+        assert!(redacted.contains("future_unknown_key = some_value"));
+    }
+
+    #[test]
+    fn redact_sensitive_ini_only_masks_within_correct_section() {
+        // A key literally named `google_api_key` outside `[provider]`
+        // would be a parse error in ConfigKey, so passes through. This
+        // proves we are NOT falling back to substring matching.
+        let input = "\
+[cache]
+google_api_key = THIS_IS_NOT_A_REAL_KEY_AND_NOT_SENSITIVE
+";
+        let redacted = redact_sensitive_ini(input);
+        assert!(redacted.contains("THIS_IS_NOT_A_REAL_KEY_AND_NOT_SENSITIVE"));
+    }
 }