# New in 0.7 | DRE

> Password-protected PDFs, zip report packs with AES-256 passwords on any destination, and secret_columns to keep passwords out of logs and results.

You're reading the docs for DRE 0.10 (v0.10.0). [This page for 0.11](https://getdre.com/docs/new-in-0.7/)

# New in 0.7

DRE 0.7 sends files only the recipient can open, without passwords leaking into DRE’s own records. It’s a minor release with nothing to change in existing projects: every new key is optional, and a project that doesn’t use them runs as before. 0.6 rejects the new keys, so upgrade every machine that runs a project before using them.

## Password-protected PDFs

`password:` on a `pdf` output encrypts each PDF with an open password (AES-256), from `each.*`, `env_var()` or `var()`. It needs the [`document` plugin](https://getdre.com/docs/v0.10/plugin-document/#password-protected-pdfs) 1.1.0 or later: `dre plugin update document`. Format options holding Jinja are now rendered by core, per row for a per-row output.

## Zip report packs

`zip:` on any destination entry delivers one zip of the output’s files plus every `attach:`ed output’s, with no password (`zip: true`) or with one (`zip: {password: ...}`, AES-256 by default, `encryption: zipcrypto` for Windows Explorer with a validate warning). Per-row outputs get a zip per row; held zips are recorded with their SHA-256 and `dre release` sends them unchanged.

## secret\_columns

`secret_columns:` on a query entry masks those columns’ values as `*****` in the console, `dre.log`, `run_results.json`, `rows.jsonl`, previews, errors and `--output-json` (and so in dre-mcp’s answers), but never in delivered files or messages. `dre validate` warns when a password reads a column that isn’t secret.

## 0.7.1

-   Secret values of every length are masked: one under 4 characters (a short PIN) where it stands alone, so `PIN 73` shows as `PIN *****` and `2073` stays readable. `mask_secrets: false` turns masking off.
-   `dre validate` reports two files with one name in a zip, instead of the run failing.
-   More password warnings: `results.<query>` columns not in `secret_columns`, a password written in the YAML or read through `var()`, and a password-like driver column printed by a per-row message or path. A password written in the YAML is now masked in DRE’s output too.

See [Password-protect PDFs and zip report packs](https://getdre.com/docs/v0.10/password-protected-outputs/).

[Previous  
New in 0.6](https://getdre.com/docs/v0.10/new-in-0.6/)[Next  
New in 0.8](https://getdre.com/docs/v0.10/new-in-0.8/)