diff --git a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/AbstractSoftwareProcessStreamsTest.java b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/AbstractSoftwareProcessStreamsTest.java
index 3ebffcb..bf40438 100644
--- a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/AbstractSoftwareProcessStreamsTest.java
+++ b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/AbstractSoftwareProcessStreamsTest.java
@@ -82,7 +82,7 @@
         return Optional.<Task<?>>absent();
     }
 
-    protected <T extends SoftwareProcess> void assertStreams(T softwareProcessEntity) {
+    protected <T extends SoftwareProcess> void assertStdStreams(T softwareProcessEntity) {
         Set<Task<?>> tasks = BrooklynTaskTags.getTasksInEntityContext(mgmt.getExecutionManager(), softwareProcessEntity);
 
         for (Map.Entry<String, String> entry : getCommands().entrySet()) {
@@ -94,11 +94,27 @@
             String stdin = getStreamOrFail(subTask, BrooklynTaskTags.STREAM_STDIN);
             String stdout = getStreamOrFail(subTask, BrooklynTaskTags.STREAM_STDOUT);
             String stderr = getStreamOrFail(subTask, BrooklynTaskTags.STREAM_STDERR);
-//            String env = getStreamOrFail(subTask, BrooklynTaskTags.STREAM_ENV);
             String msg = "taskName='" + taskNameRegex + "'; expected=" + echoed + "; actual=" + stdout + "\nstdin="+stdin+"\nstdout="+stdout+"\nstderr="+stderr; //+"; env="+env;
 
             assertTrue(stdin.contains("echo "+echoed), msg);
             assertTrue(stdout.contains(echoed), msg);
         }
     }
+
+    protected <T extends SoftwareProcess> void assertEnvStream(final T softwareProcessEntity, final Map<String, String> expectedEnv) {
+        Set<Task<?>> tasks = BrooklynTaskTags.getTasksInEntityContext(mgmt.getExecutionManager(), softwareProcessEntity);
+
+        for (Map.Entry<String, String> entry : getCommands().entrySet()) {
+            String taskNameRegex = entry.getKey();
+
+            Task<?> subTask = findTaskOrSubTask(tasks, TaskPredicates.displayNameSatisfies(StringPredicates.matchesRegex(taskNameRegex))).get();
+
+            String env = getStreamOrFail(subTask, BrooklynTaskTags.STREAM_ENV);
+
+            expectedEnv.forEach((key, value) -> {
+                String expectedLine = key + "=\"" + value + "\"";
+                assertTrue(env.contains(expectedLine), "line '" + expectedLine + "' is expected in env stream:\n" + env);
+            });
+        }
+    }
 }
diff --git a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsIntegrationTest.java b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsIntegrationTest.java
index f3cd51e..e89f2e2 100644
--- a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsIntegrationTest.java
+++ b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsIntegrationTest.java
@@ -59,7 +59,7 @@
                 .configure(VanillaSoftwareProcess.CHECK_RUNNING_COMMAND, "true"));
         app.start(ImmutableList.of(localhost));
 
-        assertStreams(entity);
+        assertStdStreams(entity);
     }
 
     @Override
diff --git a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsTest.java b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsTest.java
new file mode 100644
index 0000000..5c56ae2
--- /dev/null
+++ b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaSoftwareProcessStreamsTest.java
@@ -0,0 +1,142 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.brooklyn.entity.software.base;
+
+import com.google.common.base.Predicates;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import org.apache.brooklyn.api.entity.EntitySpec;
+import org.apache.brooklyn.api.location.Location;
+import org.apache.brooklyn.api.location.LocationSpec;
+import org.apache.brooklyn.api.location.MachineLocation;
+import org.apache.brooklyn.core.config.Sanitizer;
+import org.apache.brooklyn.location.byon.FixedListMachineProvisioningLocation;
+import org.apache.brooklyn.location.ssh.SshMachineLocation;
+import org.apache.brooklyn.util.core.internal.ssh.RecordingSshTool;
+import org.apache.brooklyn.util.core.internal.ssh.RecordingSshTool.ExecCmdPredicates;
+import org.apache.brooklyn.util.stream.Streams;
+import org.testng.annotations.AfterMethod;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import java.io.ByteArrayInputStream;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import static org.apache.brooklyn.util.core.internal.ssh.ExecCmdAsserts.*;
+
+public class VanillaSoftwareProcessStreamsTest extends AbstractSoftwareProcessStreamsTest {
+
+    private Location location;
+    
+    @BeforeMethod(alwaysRun=true)
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        location = app.getManagementContext().getLocationManager().createLocation(LocationSpec.create(FixedListMachineProvisioningLocation.class)
+                .configure(FixedListMachineProvisioningLocation.MACHINE_SPECS, ImmutableList.<LocationSpec<? extends MachineLocation>>of(
+                        LocationSpec.create(SshMachineLocation.class)
+                                .configure("address", "1.2.3.4")
+                                .configure(SshMachineLocation.SSH_TOOL_CLASS, RecordingSshTool.class.getName()))));
+        
+        RecordingSshTool.clear();
+    }
+
+    @AfterMethod(alwaysRun=true)
+    @Override
+    public void tearDown() throws Exception {
+        super.tearDown();
+        RecordingSshTool.clear();
+    }
+
+    @Test
+    public void testMaskedValuesInEnvStream() {
+
+        // Prepare expected environment variables, secret names are keys with values that should be masked in env stream
+        Map<String, String> expectedEnv = new ImmutableMap.Builder<String, String>()
+                .put("KEY1", "VAL1")
+                .putAll(Sanitizer.SECRET_NAMES.stream().collect(Collectors.toMap(item -> item, item -> item)))
+                .build();
+
+        // Create configuration
+        EntitySpec<VanillaSoftwareProcess> entitySpec = EntitySpec.create(VanillaSoftwareProcess.class)
+                .configure(VanillaSoftwareProcess.PRE_INSTALL_COMMAND, "preInstallCommand")
+                .configure(VanillaSoftwareProcess.INSTALL_COMMAND, "installCommand")
+                .configure(VanillaSoftwareProcess.POST_INSTALL_COMMAND, "postInstallCommand")
+                .configure(VanillaSoftwareProcess.PRE_CUSTOMIZE_COMMAND, "preCustomizeCommand")
+                .configure(VanillaSoftwareProcess.CUSTOMIZE_COMMAND, "customizeCommand")
+                .configure(VanillaSoftwareProcess.POST_CUSTOMIZE_COMMAND, "postCustomizeCommand")
+                .configure(VanillaSoftwareProcess.PRE_LAUNCH_COMMAND, "preLaunchCommand")
+                .configure(VanillaSoftwareProcess.LAUNCH_COMMAND, "launchCommand")
+                .configure(VanillaSoftwareProcess.POST_LAUNCH_COMMAND, "postLaunchCommand")
+                .configure(VanillaSoftwareProcess.CHECK_RUNNING_COMMAND, "checkRunningCommand")
+                .configure(VanillaSoftwareProcess.STOP_COMMAND, "stopCommand");
+
+        // Add sensitive environment variables that are expected to be masked in env stream
+        expectedEnv.forEach((key, value) -> entitySpec.configure(VanillaSoftwareProcess.SHELL_ENVIRONMENT.subKey(key), value));
+
+        // Start the application and verify that environment variables unmasked are available in all steps but stopCommand
+        VanillaSoftwareProcess entity = app.createAndManageChild(entitySpec);
+        app.start(ImmutableList.of(location));
+        assertExecsSatisfy(RecordingSshTool.getExecCmds(), ImmutableList.of(
+                Predicates.and(ExecCmdPredicates.containsCmd("preInstallCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("installCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("postInstallCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("preCustomizeCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("customizeCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("postCustomizeCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("preLaunchCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("launchCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("postLaunchCommand"), ExecCmdPredicates.containsEnv(expectedEnv)),
+                Predicates.and(ExecCmdPredicates.containsCmd("checkRunningCommand"), ExecCmdPredicates.containsEnv(expectedEnv))));
+
+        // Stop the application and verify that environment variables available in stopCommand step unmasked
+        app.stop();
+        assertExecSatisfies(
+                RecordingSshTool.getLastExecCmd(),
+                Predicates.and(ExecCmdPredicates.containsCmd("stopCommand"), ExecCmdPredicates.containsEnv(expectedEnv)));
+
+        // Calculate MD5 hash for all keys that are expected to be masked and verify them displayed masked in env stream
+        Map<String, String> expectedMaskedEnv = new ImmutableMap.Builder<String, String>()
+                .put("KEY1", "VAL1") // this key must appear unmasked, it is not in the list of SECRET NAMES to mask
+                .putAll(Sanitizer.SECRET_NAMES.stream().collect(Collectors.toMap(
+                        item -> item, // key and expected masked (suppressed) value for a SECRET NAME with MD5 hash
+                        item -> "<suppressed> (MD5 hash: " + Streams.getMd5Checksum(new ByteArrayInputStream(item.getBytes())) + ")")))
+                .build();
+        assertEnvStream(entity, expectedMaskedEnv);
+    }
+
+    @Override
+    public void testGetsStreams() {
+        // NOOP
+    }
+
+    @Override
+    protected Map<String, String> getCommands() {
+        return ImmutableMap.<String, String>builder()
+                .put("pre-install-command", "myPreInstall")
+                .put("ssh: installing.*", "myInstall")
+                .put("post-install-command", "myPostInstall")
+                .put("ssh: customizing.*", "myCustomizing")
+                .put("pre-launch-command", "myPreLaunch")
+                .put("ssh: launching.*", "myLaunch")
+                .put("post-launch-command", "myPostLaunch")
+                .build();
+    }
+}
diff --git a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaWindowsProcessWinrmStreamsLiveTest.java b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaWindowsProcessWinrmStreamsLiveTest.java
index e72e67f..ec435b3 100644
--- a/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaWindowsProcessWinrmStreamsLiveTest.java
+++ b/software/base/src/test/java/org/apache/brooklyn/entity/software/base/VanillaWindowsProcessWinrmStreamsLiveTest.java
@@ -98,7 +98,7 @@
                 .configure(VanillaSoftwareProcess.POST_LAUNCH_COMMAND, "echo " + getCommands().get("winrm: post-launch-command.*"))
                 .configure(VanillaSoftwareProcess.CHECK_RUNNING_COMMAND, "echo true"));
         app.start(ImmutableList.of(machine));
-        assertStreams(entity);
+        assertStdStreams(entity);
     }
 
     @Test(groups = "Live")
@@ -114,7 +114,7 @@
                 .configure(VanillaWindowsProcess.POST_LAUNCH_POWERSHELL_COMMAND, "echo " + getCommands().get("winrm: post-launch-command.*"))
                 .configure(VanillaWindowsProcess.CHECK_RUNNING_POWERSHELL_COMMAND, "echo true"));
         app.start(ImmutableList.of(machine));
-        assertStreams(entity);
+        assertStdStreams(entity);
     }
 
     @Override