Values are read on the server, masked, and returned to the client. Raw secret values never cross the network — only previews.
Loading…
Open DevTools → Network and inspect the server-function response. You should see only the masked previews, never the original secret values.