Masking dynamic credentials

Just want to double check with folks about masking credentials. It seems like it’s only variables that are in CI/CD and those from built-in integrations. How are folks making sure that things don’t get out in simple echo statements?