Return value of String() is not safe to use because it may contain unredacted password. If not careful, a password may leak out to logs and subsequently spread to other channels. I propose to modify the Stringer to replace any non-empty string with <redacted>. I'll follow up with a pull-request if the issue gets accepted.