This @config is an array of hashes, not a real class, so using 'secret_attr' will not help. It's buried here: https://github.com/yast/yast-iscsi-client/blob/master/src/lib/y2iscsi_client/config.rb I suggest to simply remove that y2milestone line (see comment #5).