User sees what will change. Secrets are automatically redacted. Will require `diff` plugin installation, somehow.