Log masking is a highlighter, not a vault: it only catches the exact string.

CI platforms hide secrets in logs by replacing exact matches of the stored value. If a step transforms the value first (base64, split into pieces, URL-encoded), the result no longer matches and can print in clear. So the safe habit is never to echo secrets at all, rather than counting on the mask.

Read it once, then a question tests whether the trick stuck.