import os
import subprocess
import sys


def test_missing_secret_fails_without_disclosing_other_credentials():
    env = dict(os.environ)
    env.pop("DJANGO_SECRET_KEY", None)
    env["DB_PASSWORD"] = "private-password-marker"
    result = subprocess.run([sys.executable, "manage.py", "check"], env=env, capture_output=True, text=True)
    assert result.returncode != 0
    assert "Set DJANGO_SECRET_KEY" in result.stderr
    assert "private-password-marker" not in result.stderr