fix(server): prevent SSD CLI secret mask spoofing (#29089)