When overriding default settings values like FTP_PASSWORD or MAIL_PASS they're automatically displayed on console output.
2020-10-01 14:20:45 [scrapy.utils.log] INFO: Scrapy 2.1.0 started (bot: foo)
2020-10-01 14:20:45 [scrapy.utils.log] INFO: Versions: lxml 4.5.0.0, libxml2 2.9.5, cssselect 1.1.0, parsel 1.5.2, w3lib 1.21.0, Twisted 19.10.0, Python 3.7.6
2020-10-01 14:20:45 [scrapy.utils.log] DEBUG: Using reactor: twisted.internet.selectreactor.SelectReactor
2020-10-01 14:20:45 [scrapy.crawler] INFO: Overridden settings:
{'BOT_NAME': 'foo',
'MAIL_FROM': 'foo@bar.com',
'MAIL_HOST': 'smtp.foo',
'MAIL_PASS': 'baz',
'MAIL_PORT': 587,
'MAIL_USER': 'foo',
'USER_AGENT': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 '
'Firefox/64.0'}
2020-10-01 14:20:45 [scrapy.extensions.telnet] INFO: Telnet Password: 1ca2431dbad58eed
...
One solution could be to simply disable log with LOG_ENABLED=False but I'm looking for a way to remove it or hide the value as the log might be shared with third parties.