I just replied in a thread - but a tl;dr is also in the FAQ at https://pulumi.io/reference/faq.html#are-my-secrets-ever-visible.