In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.