`coverage debug sys` can expose secrets

[nedbat]

The coverage debug sys command shows lots of details of your system, including a subset of your environment variables. Those can include secrets like PYPI_TOKEN. These should be cloaked somehow.

[nedbat]

FWIW, Django avoids showing settings with these words in them:

"API|TOKEN|KEY|SECRET|PASS|SIGNATURE"

https://github.com/django/django/blob/839d403e50eafa49a7e4a5a13ad818844ff9305b/django/views/debug.py#L113

[nedbat]

This is fixed in 3fb8da5.

[nedbat]

This is now released as part of coverage 7.2.6.