PHP 8.2 introduced the SensitiveParameter attribute to prevent credentials from leaking in stack traces. When an error occurs, PHP normally prints function arguments in debugging output. That behavior exposes passwords, API keys, and tokens in logs and error pages.

Adding #[SensitiveParameter] to a function argument tells PHP to wrap the value in a SensitiveParameterValue object instead of printing the raw data. The actual code still works normally, but stack traces show a redacted placeholder. For values stored in class properties, developers can manually wrap them in SensitiveParameterValue to get the same protection.

This feature addresses a common leak vector: helpful diagnostics that accidentally publish secrets. It complements existing security practices like proper logging policies and secret management, but adds a safety net for human error. The performance impact is negligible, making it practical to mark any confidential parameter.

Think of it as a seatbelt for observability—simple, low-cost protection against credential leaks.