How to keep secrets and PII out of Playwright traces and artifacts

Playwright traces, screenshots, videos, and other test artifacts can capture more than test results. They may also contain secrets such as passwords and API keys, or Personally Identifiable Information (PII) such as names, email addresses, phone numbers, and account information.

To reduce exposure, keep sensitive values out of the test code itself and use appropriate test data wherever possible.

Leapwork Play supports this workflow with team-level secrets that can be referenced from the generated Playwright code instead of hardcoding the secret value. The demonstrated workflow stores the secret in the team's Secrets section and retrieves it with leapwork.variables.getSecret().

Try Leapwork Play →

How do you keep passwords out of Playwright test code?

Do not put the real password directly into the test:

await page.getByRole('textbox', {
  name: 'Password'
}).fill('MyRealPassword');

Instead, retrieve the value from your approved secret-management mechanism at runtime.

In Leapwork Play, the generated Playwright code can reference a stored team secret:

await page.getByRole('textbox', {
  name: 'Password'
}).fill(
  leapwork.variables.getSecret('user-password')
);

The secret value is stored separately from the test code.

How does Play keep secrets out of the test?

In the demonstrated Play workflow:

Open the team's Secrets section.
Add the secret name and secret value.
Keep the stored value masked.
Reference the secret from the Playwright test with leapwork.variables.getSecret().
Run the test without placing the secret itself in the test code.

The demo shows the password value remaining masked in the team's Secrets section while the Playwright implementation retrieves it through getSecret().

How to keep sensitive values out of tests and artifacts

Treat more than passwords as sensitive. Keep any value that could expose systems, users, or confidential information out of test code and recorded test data.

Identify sensitive values. Look for passwords, API keys, access tokens, personal information, and any other credentials or confidential values.
Remove the values from tests and artifacts. Do not hard-code secrets in test code, fixtures, logs, screenshots, recordings, or generated artifacts.
Reference secrets indirectly. Store the secret in an approved team secret store and reference it by name from the test.
Inject the value at runtime. Let the test retrieve the secret only when it runs, so the test logic stays separate from the secret value.

How Play extends the Playwright secret-handling workflow

With Playwright	With Leapwork Play
Keep sensitive values outside test code	Store secrets in the team's Secrets section
Retrieve the value through your secret-management approach	Reference the stored value with `leapwork.variables.getSecret()`
Avoid committing credentials to source control	Keep the secret separate from the recorded Playwright implementation
Review how sensitive test data is handled	Manage the secret centrally at team level

Play keeps Playwright underneath while adding a managed way to reference stored secrets from the test workflow.

What about PII in screenshots and traces?

Keeping passwords out of source code is only one part of protecting sensitive test data. A test can still expose PII if that information appears directly in the application during execution for example, in a page screenshot or recorded browser state.

Before sharing or retaining execution artifacts, check whether they contain:

Customer names
Email addresses
Phone numbers
Account information
Other personal or confidential data

Use test data that is appropriate for automated testing and avoid exposing real customer information in test environments and artifacts.

Important: Storing a password as a secret prevents the value from being hardcoded in the Playwright test. It does not automatically make every piece of data displayed by the application safe to include in screenshots, traces, or other execution artifacts.

Best practices

Store passwords and other credentials as secrets instead of hardcoding them in Playwright code.
Use leapwork.variables.getSecret() to retrieve stored Play secrets at runtime.
Keep real customer PII out of test data whenever possible.
Review screenshots, traces, and other artifacts before sharing them outside the appropriate team.
Never commit credentials or other sensitive values to source control.
Use dedicated test accounts and test data for automated testing.

Troubleshooting

Problem	What to check
A password appears in the Playwright code	Replace the hardcoded value with a secret reference
The secret is not available during execution	Check that the secret exists in the team's Secrets section and that the test references the correct name
Sensitive information appears in a screenshot	Check the test data and the page state captured during execution
PII appears in execution artifacts	Replace real user data with suitable test data where possible
A teammate needs to use the same credential	Store it as a managed team secret rather than copying it into individual tests

Frequently asked questions

Should passwords be hardcoded in Playwright tests?

No. Keep passwords and other credentials outside the test code and retrieve them securely at runtime.

How does Leapwork Play store passwords?

The demonstrated workflow stores the secret in the team's Secrets section, where the stored value is masked.

How do I reference a secret in Playwright code generated by Play?

Use leapwork.variables.getSecret() to retrieve the stored secret at runtime.

leapwork.variables.getSecret('user-password');

Does using a secret automatically remove PII from screenshots and traces?

No. Secret management protects the secret value from being hardcoded in the test. PII displayed by the application can still appear in execution artifacts and should be handled separately.

What sensitive information should I keep out of Playwright tests?

Keep passwords, API keys, tokens, personal information, and other confidential values out of the test code whenever possible.