diff --git a/ChangeLog b/ChangeLog
index 3be37d2c7..0cdc191b0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,9 @@
      reset SIGCHLD handler before fork (and restore it after) so we don't miss
      the the askpass child's exit status. Correct test for exit status/signal to
      account for waitpid() failure; with claudio@ ok claudio@ markus@
+   - djm@cvs.openbsd.org 2010/12/24 21:41:48
+     [auth-options.c]
+     don't send the actual forced command in a debug message; ok markus deraadt
 
 20110104
  - (djm) [configure.ac Makefile.in] Use mandoc as preferred manpage
diff --git a/auth-options.c b/auth-options.c
index a9c26add6..eae45cf2b 100644
--- a/auth-options.c
+++ b/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.53 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.54 2010/12/24 21:41:48 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -172,7 +172,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				goto bad_option;
 			}
 			forced_command[i] = '\0';
-			auth_debug_add("Forced command: %.900s", forced_command);
+			auth_debug_add("Forced command.");
 			opts++;
 			goto next_option;
 		}