Secrets (within quotes) that are part of Variable Group linked to KeyVault are not masked in logs about azure-pipelines-task-lib

[krsanty]

Just realized that I should have used BackTick as the escape character for the PowerShell script. It masked the secret properly when the secret value in KV was changed from \"SHOULDBEHIDDEN\" to `"SHOULDBEHIDDEN`".

However, since we are using non PowerShell script as well in our pipeline, adding the escape character within the secret text opens up problems in other scripts where it is not treated as escape character. It there a better way to mask the secrets in PowerShell tasks?

[krsanty]

Closing the issue because I think I found the solution.
Setting new task variable and then assigning it the secret.
Write-Host "##vso[task.setvariable variable=secretwithdoublequotes;issecret=true]$(secretwithdoublequotes)"

Thereafter, using the variable in this format {$(secretwithdoublequotes)} to avoid the leak.