New in 0.7
DRE 0.7 sends files only the recipient can open, without passwords leaking into DRE’s own records. It’s a minor release with nothing to change in existing projects: every new key is optional, and a project that doesn’t use them runs as before. 0.6 rejects the new keys, so upgrade every machine that runs a project before using them.
Password-protected PDFs
Section titled “Password-protected PDFs”password: on a pdf output encrypts each PDF with an open password (AES-256), from each.*,
env_var() or var(). It needs the document plugin
1.1.0 or later: dre plugin update document. Format options holding Jinja are now rendered by
core, per row for a per-row output.
Zip report packs
Section titled “Zip report packs”zip: on any destination entry delivers one zip of the output’s files plus every attach:ed
output’s, with no password (zip: true) or with one (zip: {password: ...}, AES-256 by default,
encryption: zipcrypto for Windows Explorer with a validate warning). Per-row outputs get a zip
per row; held zips are recorded with their SHA-256 and dre release sends them unchanged.
secret_columns
Section titled “secret_columns”secret_columns: on a query entry masks those columns’ values as ***** in the console,
dre.log, run_results.json, rows.jsonl, previews, errors and --output-json (and so in
dre-mcp’s answers), but never in delivered files or messages. dre validate warns when a
password reads a column that isn’t secret.
- Secret values of every length are masked: one under 4 characters (a short PIN) where it stands
alone, so
PIN 73shows asPIN *****and2073stays readable.mask_secrets: falseturns masking off. dre validatereports two files with one name in a zip, instead of the run failing.- More password warnings:
results.<query>columns not insecret_columns, a password written in the YAML or read throughvar(), and a password-like driver column printed by a per-row message or path. A password written in the YAML is now masked in DRE’s output too.