Just something along the lines of:

###Passwords and other sensitive information

In order to support sensitive information we have the following parameters available to control how entries within Puppet logfiles look.

####keep_secret

This parameter allows you to prevent outputting actual values contained within the catalog to the logfile.  Possible values are:

* `false`:  This allows all values to be passed to logfiles. (default)
* `true`: The values in the logfiles will be replaced with `[redacted sensitive information]`.

(something like that, then with the corresponding change to sorry this is secret to match the wording!)