Passwords for the user type are output in Debug logging, even if the value is marked Sensitive. Instead, this should be written as "[redacted]" in the log.
Passwords for theReproduction steps: {code:java}$ cat foo.pp class foo { user type are output in Debug logging {'foo': ensure => present, even if the value is marked password => Sensitive. Instead, this should be written as( "[redacted]foo" in the log) } }