Conduct an audit of the whole codebase, verifying secrets are used properly

[IaroslavTitov]

Ask

Recently we had an incident where improper marshaling settings resulted in secrets leaking - https://github.com/pulumi/pulumi-pulumiservice/pull/381

• Conduct an audit of the whole projects, making sure secrets are properly treated. Possibly, we can replace all MarshalSettings with a const to avoid such issues in the future.
• Add tests that verify secrets are kept hidden to avoid regressions like this

[aureq]

@IaroslavTitov Do you think #384 should be looked at as part of this issue?

[IaroslavTitov]

@IaroslavTitov Do you think #384 should be looked at as part of this issue?

Potentially yes. If the config secret way I linked in that issue doesn't work, then that issue is a security hole somewhere, but I'm hoping it works