Salesforce CLI Security Update: Prepare Your CI/CD Pipelines

Salesforce is changing how the Salesforce CLI (SF CLI) handles sensitive information such as access tokens and authentication URLs. The aim is to stop credentials being exposed by accident, particularly in AI-assisted workflows. It affects existing CI/CD pipelines and automation scripts that read those values, so you will have to move them onto new command structures.

The changes are in the SF CLI release candidate (RC) now and reach the production release on Wednesday, May 27, 2026. If you have not prepared by then, your deployment process could be significantly disrupted.

What changes in credential handling

Mitch Spano, Director of Product Management at Salesforce, says the goal is to redact secrets from both the human-readable and --json output of common commands. So sf org display no longer hands you the sensitive artifact directly.

These commands are affected:

• sf org display
• sf org list
• sf org create scratch
• sf org resume scratch
• sf org display user
• sf org list users
• sf org login jwt
• sf org login web
• sf org login sfdx-url
• sf org login access-token
• sf org list auth

Each of them now redacts the Access Token, the Auth URL and the Password.

New commands for credential retrieval

To get at sensitive information from now on, you use new dedicated commands. They are explicit and interactive by design, so exposing a credential takes a deliberate action:

• sf org auth show-access-token: Retrieves the Access Token.
• sf org auth show-sfdx-auth-url: Retrieves the SFDX Auth URL.
• sf org auth show-user-password: Retrieves the user's password.

They are interactive by default and print a security warning. In non-interactive environments such as CI/CD pipelines you must append --json or --no-prompts to them.

Temporary workaround and migration timeline

Salesforce acknowledges that pipelines may break immediately and has provided a temporary environment variable: SF_TEMP_SHOW_SECRETS=true. Inject it into your CI/CD environment and you keep the legacy behavior for now.

Two dates matter:

• May 27, 2026, the production release. Secrets come out of the existing commands. If your pipelines break, deploy the temporary environment variable straight away.
• Summer 2026. The temporary environment variable is decommissioned permanently. Every workflow must be on the new dedicated commands by then.

Review and refactor your CI/CD scripts onto the new explicit commands as soon as you can, rather than settling into the workaround.

Rationale behind the changes

This is part of a longer strategy to strengthen the security posture of the Salesforce CLI. A recent soql-in-loops-security-review-impact-for-managed-packages/" class="auto-link">security review found elevated risk in sensitive credentials being exposed through standard CLI workflows, especially now that AI coding agents may log execution output in plain text.

With an explicit retrieval model, reaching a credential takes deliberate user intent and is clearly marked as a high-risk operation.

Community reaction and concerns

Few people argue with the security case. The speed of the timeline is what has the developer community worried, because of what it does to CI/CD pipelines. Some developers have pointed out that no functionality is being removed, it is being "reshuffled," and adapting existing automation still takes significant effort.

There is an architectural worry too: one compromise of the SF CLI could grant access to multiple Salesforce orgs, which matters most for consultancies managing numerous client environments. People have also discussed tighter measures later, such as multi-factor authentication for CLI connections, which would force a separation between developer commands and CI/CD automation commands.

What to do now

1. Audit your CI/CD scripts immediately. Find every pipeline and automation script that talks to the SF CLI and depends on sensitive credential output.
2. Refactor those scripts onto the new sf org auth show-* commands.
3. Append --json or --no-prompts to the new credential retrieval commands so they work non-interactively in CI/CD.
4. If a pipeline breaks after May 27, deploy the SF_TEMP_SHOW_SECRETS=true environment variable as a temporary measure.
5. Plan the permanent migration so every workflow is on the new commands before the temporary workaround is removed in Summer 2026.
6. Watch the official Salesforce CLI GitHub repository for detailed updates and discussion.