Generic way to redact credentials in script output

#!/bin/bash

## Ensure we redact credentials in output
redact_creds() {
  sed 's/\(password[:="\\ ]*\)[^" ]*/\1<REDACTED>/ig'
}
exec > >(redact_creds) 2>&1

## Example code
set -x

PASSWORD='secret_stuff@##/#@'
export KAFKA_SASL_JAAS_CONFIG="org.apache.kafka.common.security.plain.PlainLoginModule\ required\ username\=\"${USERNAME}\"\ password\=\"${PASSWORD}\";"
echo "KAFKA_SASL_JAAS_CONFIG=$KAFKA_SASL_JAAS_CONFIG"
echo "KAFKA_SASL_JAAS_CONFIG=$KAFKA_SASL_JAAS_CONFIG" 1>&2