Preserve secret tags in dynamic configuration values

projection.go

@@ -117,6 +117,15 @@ func (o *valueOperation) project(value reflect.Value, descriptor *typeDescriptor
 			seen[member.name] = true
 			result.Mapping = append(result.Mapping, document.Entry{Key: member.name, Value: child})
 		}
+		for _, entry := range result.Mapping {
+			field := descriptor.inlineMap
+			if index, ok := descriptor.fieldByName[entry.Key]; ok {
+				field = &descriptor.fields[index]
+			}
+			if field != nil && field.secret {
+				entry.Value.Sensitive = true
+			}
+		}
 		return result, nil
 	case descriptorMap:
 		if value.IsNil() {