Why doesn't the YAML preview show my passwords or tokens?

Why this happens

A preview you can copy, paste into a ticket or share on a call should never hold live credentials. The API describes the endpoint as a preview of the generated scanner config with no secrets. Saved secrets follow the same rule everywhere. Cyberlop encrypts them at rest and never displays them again.

So an empty password field on an edit screen does not mean the password is gone.

How to fix it

1. Open Scan Profiles and click edit on the profile.
2. Go to Authentication and look at the role. A notice reads "Form credentials stored — leave fields blank to keep it."
3. Leave that field empty if you want to keep the secret. A blank field keeps the stored value.
4. Type the new value in the field when you need to replace it, or click Clear to remove it.
5. Click Preview YAML to check the rest of the config, then Save.

Still not working?

If a scan fails at login, the stored credential may be wrong. Enter the right value, save, and run again. Use Complete authentication on an OAuth 2.0 role to test the token exchange before you save.

An error such as "name: String must contain at least 1 character(s)" means the form needs a profile name, and it has nothing to do with secrets. For help with a stubborn case, use our contact page. Read how to edit a role and keep its password for more.

Related questions

• How do I preview the YAML config a profile generates?
• Why is the password field empty when I edit my profile?
• What does "Form credentials stored — leave fields blank to keep it." mean?
• Why can't I see my saved token or key any more?
• How do I edit a role without re-entering its password?

Full tutorial

How to edit a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre