diff --git a/README.md b/README.md
index 224fc64..27f31f1 100644
--- a/README.md
+++ b/README.md
@@ -314,7 +314,7 @@ The configuration on Windows is slightly different compared to Linux or macOS. U
 | `DOKPLOY_TIMEOUT` | No | Request timeout in milliseconds (default: `30000`) |
 | `DOKPLOY_RETRY_ATTEMPTS` | No | Number of retry attempts (default: `3`) |
 | `DOKPLOY_RETRY_DELAY` | No | Delay between retries in milliseconds (default: `1000`) |
-| `DOKPLOY_REDACT_ENV` | No | When `true`, redacts secret-bearing fields from API responses before they reach the MCP client (default: `false`). Useful when an LLM consumes responses and you don't want env vars or compose files in its context. |
+| `DOKPLOY_REDACT_ENV` | No | Redacts secret-bearing fields (env vars, compose files, passwords, tokens, keys) from API responses before they reach the MCP client (default: `true`). Set to `false` only if you explicitly need raw secret values in LLM context. |
 | `DOKPLOY_REDACT_FIELDS` | No | Comma-separated list of response field names to redact when `DOKPLOY_REDACT_ENV=true`. Matched case-insensitively at any nesting depth. Defaults to: `env`, `buildArgs`, `composeFile`, `dockerCompose`, `environment`, `buildSecrets`, `previewBuildSecrets`, `password`, `currentPassword`, `appPassword`, `databasePassword`, `databaseRootPassword`, `redisPassword`, `mariadbPassword`, `mongoPassword`, `mysqlPassword`, `postgresPassword`, `registryPassword`, `token`, `accessToken`, `appToken`, `apiToken`, `botToken`, `refreshToken`, `secret`, `clientSecret`, `apiKey`, `secretAccessKey`, `accessKey`, `licenseKey`, `userKey`, `privateKey`, `privateKeyPass`, `encPrivateKey`, `encPrivateKeyPass`, `sshKey`, `sshPrivateKey`, `customGitSSHKey`, `dockerAuth`. |
 
 For Dokploy instances behind Cloudflare Access or a similar reverse proxy, pass service-token headers with placeholder values like this:
diff --git a/src/utils/clientConfig.test.ts b/src/utils/clientConfig.test.ts
index 008dc9f..304e691 100644
--- a/src/utils/clientConfig.test.ts
+++ b/src/utils/clientConfig.test.ts
@@ -58,3 +58,17 @@ describe("parseCustomHeaders", () => {
     );
   });
 });
+
+describe("getClientConfig", () => {
+  it("enables response redaction by default", async () => {
+    process.env.DOKPLOY_URL = "https://example.com";
+    process.env.DOKPLOY_API_KEY = "test-key";
+    delete process.env.DOKPLOY_REDACT_ENV;
+
+    const { getClientConfig } = await import("./clientConfig.js");
+    const config = getClientConfig();
+
+    expect(config.redactEnv).toBe(true);
+    expect(config.redactFields.length).toBeGreaterThan(0);
+  });
+});
diff --git a/src/utils/clientConfig.ts b/src/utils/clientConfig.ts
index aac3d43..b9dae1b 100644
--- a/src/utils/clientConfig.ts
+++ b/src/utils/clientConfig.ts
@@ -89,7 +89,7 @@ class ConfigManager {
       throw new Error("Environment variable DOKPLOY_API_KEY is not defined");
     }
 
-    const redactEnv = parseBoolean(process.env.DOKPLOY_REDACT_ENV, false);
+    const redactEnv = parseBoolean(process.env.DOKPLOY_REDACT_ENV, true);
     const parsedFields =
       process.env.DOKPLOY_REDACT_FIELDS?.split(",")
         .map((f) => f.trim())