We need this optionality right down to the individual secret level, as some variables are not secret and can create confusing masking in the logs (e.g. USER=testing -> masking of "testing" throughout the logs)

This functionality has introduced quite a bit of a confusion. Working in company that has new repositories created almost on a daily basis, this has been a hassle requesting to disable it for each and every new repository.

If there was a way for org to disable it by default for all new repositories and have a toggle to turn it on or off them individually would be awesome.

I would absolutely appreciate more granularity - it is currently masking out stack names (which are not secrets, especially for internal logs), so it appears to be very aggressive. Localized fine-tuning seems a bit of a must

Wholeheartedly agree, not every environment variable I use is actually a secret

See also: https://ideas.circleci.com/ideas/CCI-I-1223 .

(Having the ability to mark some secrets as not-really-secret, but just configuration)

+1

This would actually make sense for specific steps, so it could be great to make it an option at the step/job level in the CircleCI configuration file.