7 files changed, 39 insertions, 7 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index aca6068..916a9a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [2.1.0](https://github.com/blackm0re/etoolkit/tree/2.1.0) (2024-12-26)
+
+[Full Changelog](https://github.com/blackm0re/etoolkit/compare/2.0.0...2.1.0)
+
+**Changes:**
+
+- add encrypted values to *ETOOLKIT_SENSITIVE* implicitly
+
+
 ## [2.0.0](https://github.com/blackm0re/etoolkit/tree/2.0.0) (2024-05-13)
 
 [Full Changelog](https://github.com/blackm0re/etoolkit/compare/1.2.0...2.0.0)
diff --git a/README.md b/README.md
index 45c230a..b4f7efe 100644
--- a/README.md
+++ b/README.md
@@ -297,6 +297,10 @@ will prompt for the current master password, then for a new master password
 (with confirmation) and finally the new config file (if "all") or instance
 contents will be displayed.
 
+The values of variables listed in *ETOOLKIT_SENSITIVE* will not be displayed
+when an instance is loaded. The keys of encrypted values will be be added to
+*ETOOLKIT_SENSITIVE* implicitly.
+
 Contact the author for questions and suggestions! :)
 
 
diff --git a/setup.cfg b/setup.cfg
index 4985370..1838e18 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -15,12 +15,12 @@ classifiers =
     Intended Audience :: System Administrators
     License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
     Programming Language :: Python :: 3.12
     Programming Language :: Python :: 3.13
+    Programming Language :: Python :: 3.14
     Operating System :: POSIX
     Topic :: Security :: Cryptography
 
@@ -32,7 +32,7 @@ project_urls =
 package_dir =
     = src
 packages = find:
-python_requires = >=3.8
+python_requires = >=3.9
 
 install_requires =
     cryptography>=3.2
diff --git a/src/etoolkit/__init__.py b/src/etoolkit/__init__.py
index 711c6ae..4cf5d6e 100644
--- a/src/etoolkit/__init__.py
+++ b/src/etoolkit/__init__.py
@@ -18,7 +18,7 @@
 from .etoolkit import EtoolkitInstance, EtoolkitInstanceError
 
 __author__ = 'Simeon Simeonov'
-__version__ = '2.0.0'
+__version__ = '2.1.0'
 __license__ = 'GPL3'
 
 
diff --git a/src/etoolkit/etoolkit.py b/src/etoolkit/etoolkit.py
index 9a1b47e..a933a01 100644
--- a/src/etoolkit/etoolkit.py
+++ b/src/etoolkit/etoolkit.py
@@ -43,6 +43,7 @@ class EtoolkitInstance:
         """
         self._name = name
         self._parent = None
+        self._env = None
         self._raw_env_variables = {}
         self._sensitive_env_variables = []
         self._master_password = None
@@ -57,9 +58,6 @@ class EtoolkitInstance:
                 self._instance_data['ETOOLKIT_PARENT'], data
             )
             self._raw_env_variables.update(self._parent.raw_env_variables)
-            self._sensitive_env_variables.extend(
-                self._parent.sensitive_env_variables
-            )
         if self._instance_data.get('ETOOLKIT_SENSITIVE'):
             if not isinstance(self._instance_data['ETOOLKIT_SENSITIVE'], list):
                 raise EtoolkitInstanceError(
@@ -399,6 +397,9 @@ class EtoolkitInstance:
         :return: New environment dict with all macros replaced by their values
         :rtype: dict
         """
+        if self._env is not None:
+            return self._env
+
         macros = {
             '%h': os.path.expanduser('~'),
             '%i': self.name,
@@ -419,6 +420,8 @@ class EtoolkitInstance:
                 )
             if isinstance(value, str) and value.startswith('enc-val$'):
                 value = self._decrypt_value(value)
+                if key not in self._sensitive_env_variables:
+                    self._sensitive_env_variables.append(key)
             if isinstance(value, str) and value.endswith(':'):
                 # if 'value' ends with ':', append the existing value of
                 # os.environ[key] after the value of 'value'
@@ -434,6 +437,15 @@ class EtoolkitInstance:
             else:
                 # completely overwrite the existing value of os.environ[key]
                 new_env[key] = self.parse_value(value, macros)
+
+        # add the sensitive variables list of the parent (if any)
+        if self._parent is not None:
+            self._sensitive_env_variables.extend(
+                self._parent.sensitive_env_variables
+            )
+
+        self._env = new_env
+
         return new_env
 
     def get_full_name(self, delimiter: str = '') -> str:
diff --git a/tests/conftest.py b/tests/conftest.py
index 37dd184..a4463fd 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -49,6 +49,11 @@ def config_data():
                     '+YYrZbwTBuG0Pl+WMQrvxLUtq5j8qYuQqz'
                     'oIwgoGt7AaWZCJz+E7qoDeg3wke70ST8U='
                 ),
+                'ETOOLKIT_TEST_PASSWORD2': (
+                    'enc-val$2$RCSZqq9pWrRDoCVYVHopyu1LzaJGfv8roVviqrLTBxM=$'
+                    '+YYrZbwTBuG0Pl+WMQrvxLUtq5j8qYuQqz'
+                    'oIwgoGt7AaWZCJz+E7qoDeg3wke70ST8U='
+                ),
             },
         },
     }
diff --git a/tests/test_envtoolkit_instance.py b/tests/test_envtoolkit_instance.py
index 9873d57..f555f81 100644
--- a/tests/test_envtoolkit_instance.py
+++ b/tests/test_envtoolkit_instance.py
@@ -31,7 +31,8 @@ def test_instantiation(config_data):
     instance = etoolkit.EtoolkitInstance('secret', config_data)
     assert 'ETOOLKIT_PARENT' not in instance.raw_env_variables
     assert 'ETOOLKIT_SENSITIVE' not in instance.raw_env_variables
-    assert 'DB_CONNECTION' not in instance.sensitive_env_variables
+    assert 'GNUPGHOME' not in instance.sensitive_env_variables
+    assert 'ETOOLKIT_TEST_PASSWORD2' not in instance.sensitive_env_variables
     assert 'ETOOLKIT_TEST_PASSWORD' in instance.sensitive_env_variables
     assert instance.name == 'secret'
     assert (
@@ -64,6 +65,7 @@ def test_get_environ(
     env = instance.get_environ()
     assert isinstance(env, dict)
     assert env['ETOOLKIT_TEST_PASSWORD'] == short_value
+    assert 'ETOOLKIT_TEST_PASSWORD2' in instance.sensitive_env_variables
 
 
 def test_get_full_name(config_data):