diff --git a/src/mounts.js b/src/mounts.js
index 11f245eaf..8b8edc322 100644
--- a/src/mounts.js
+++ b/src/mounts.js
@@ -14,7 +14,6 @@ const assert = require('assert'),
     fs = require('fs'),
     path = require('path'),
     paths = require('./paths.js'),
-    promiseRetry = require('./promise-retry.js'),
     safe = require('safetydance'),
     shell = require('./shell.js');
 
diff --git a/src/routes/volumes.js b/src/routes/volumes.js
index 06ce0c672..c5cd7985e 100644
--- a/src/routes/volumes.js
+++ b/src/routes/volumes.js
@@ -45,7 +45,7 @@ async function add(req, res, next) {
 async function get(req, res, next) {
     assert.strictEqual(typeof req.params.id, 'string');
 
-    next(new HttpSuccess(200, req.resource));
+    next(new HttpSuccess(200, volumes.removePrivateFields(req.resource)));
 }
 
 async function del(req, res, next) {
@@ -59,7 +59,10 @@ async function del(req, res, next) {
 async function list(req, res, next) {
     const [error, result] = await safe(volumes.list());
     if (error) return next(BoxError.toHttpError(error));
-    next(new HttpSuccess(200, { volumes: result }));
+
+    const allVolumes = result.map(volumes.removePrivateFields);
+
+    next(new HttpSuccess(200, { volumes: allVolumes }));
 }
 
 async function getStatus(req, res, next) {
diff --git a/src/volumes.js b/src/volumes.js
index ac3782267..4540322a8 100644
--- a/src/volumes.js
+++ b/src/volumes.js
@@ -6,6 +6,7 @@ exports = module.exports = {
     del,
     list,
     getStatus,
+    removePrivateFields
 };
 
 const assert = require('assert'),
@@ -111,6 +112,18 @@ async function getStatus(volume) {
     return await mounts.getStatus(volume.mountType, volume.hostPath); // { state, message }
 }
 
+function removePrivateFields(volume) {
+    const newVolume = Object.assign({}, volume);
+
+    if (newVolume.mountType === 'sshfs') {
+        newVolume.mountOptions.privateKey = constants.SECRET_PLACEHOLDER;
+    } else if (newVolume.mountType === 'cifs') {
+        newVolume.mountOptions.password = constants.SECRET_PLACEHOLDER;
+    }
+
+    return newVolume;
+}
+
 async function get(id) {
     assert.strictEqual(typeof id, 'string');