Although Canary is designed not to hold sensitive data, someone (even an attacker) can attempt to log in to your Canary with legitimate credentials.
Of course, once credentials have been "given away", they should be rolled as a matter of good practice, but what if you have your alerts piped to Slack, Email, PagerDuty, etc. Did those real credentials now end up in all those channels?
Data Masking is the answer!
Data Masking: Enabled
Data Masking: Disabled
You should definitely still roll those credentials, but this way it feels a little less icky.
As of our most recent update, you now have the option of configuring masking of sensitive data in two locations:
Option 1: Masking of Sensitive Data on the Canary — sensitive data will never reach your Console, it gets discarded by the Canary when capturing the alert. This requires the Canary in question to be running version 3.x.4 or higher, or 3.3.5 for AWS Canaries.
Option 2: Masking of Sensitive Data in the Console — sensitive data will be relayed to the Console by the Canary, but the Console will not include that sensitive data in an alert notification via email or SMS. This is supported for all Canary versions.
Option 1: Masking of Sensitive Data on the Canary
Step 1: Log in to your Console.
Step 2: Open Canary Settings
Click on the Canary, and then hit the Configure Canary button on the bottom right of the summary screen.
Step 3: Enable Data Masking
On the Canary's configuration screen, click the toggle to enable Masking of Sensitive Data in Alerts
That's it!
Option 2: Masking of Sensitive Data on the Console
Step 1: Log in to your Console.
Step 2: Open Global Settings
Click on the Gear Icon and select Global Settings.
Step 3: Enable data masking
Enable Mask Sensitive Data.
That's it!