diff --git a/testdata/get__secret__err.ct b/testdata/get__secret__err.ct
new file mode 100644
index 0000000..05d2a66
--- /dev/null
+++ b/testdata/get__secret__err.ct
@@ -0,0 +1,15 @@
+$ pda set a b --secret
+$ pda get a --> FAIL
+Error: "a" is marked secret; re-run with --secret to display it
+Usage:
+  pda get KEY[@DB] [flags]
+
+Aliases:
+  get, g
+
+Flags:
+  -h, --help             help for get
+  -b, --include-binary   include binary data in text output
+      --no-template      directly output template syntax
+  -c, --run              execute the result as a shell command
+      --secret           display values marked as secret
diff --git a/testdata/get__secret__err__with__binary.ct b/testdata/get__secret__err__with__binary.ct
new file mode 100644
index 0000000..a2b0300
--- /dev/null
+++ b/testdata/get__secret__err__with__binary.ct
@@ -0,0 +1,16 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --include-binary --> FAIL
+Error: "a" is marked secret; re-run with --secret to display it
+Usage:
+  pda get KEY[@DB] [flags]
+
+Aliases:
+  get, g
+
+Flags:
+  -h, --help             help for get
+  -b, --include-binary   include binary data in text output
+      --no-template      directly output template syntax
+  -c, --run              execute the result as a shell command
+      --secret           display values marked as secret
diff --git a/testdata/get__secret__err__with__binary_run.ct b/testdata/get__secret__err__with__binary_run.ct
new file mode 100644
index 0000000..6d84bbd
--- /dev/null
+++ b/testdata/get__secret__err__with__binary_run.ct
@@ -0,0 +1,16 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --include-binary --run --> FAIL
+Error: "a" is marked secret; re-run with --secret to display it
+Usage:
+  pda get KEY[@DB] [flags]
+
+Aliases:
+  get, g
+
+Flags:
+  -h, --help             help for get
+  -b, --include-binary   include binary data in text output
+      --no-template      directly output template syntax
+  -c, --run              execute the result as a shell command
+      --secret           display values marked as secret
diff --git a/testdata/get__secret__err__with__run.ct b/testdata/get__secret__err__with__run.ct
new file mode 100644
index 0000000..be8b212
--- /dev/null
+++ b/testdata/get__secret__err__with__run.ct
@@ -0,0 +1,16 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --run --> FAIL
+Error: "a" is marked secret; re-run with --secret to display it
+Usage:
+  pda get KEY[@DB] [flags]
+
+Aliases:
+  get, g
+
+Flags:
+  -h, --help             help for get
+  -b, --include-binary   include binary data in text output
+      --no-template      directly output template syntax
+  -c, --run              execute the result as a shell command
+      --secret           display values marked as secret
diff --git a/testdata/get__secret__ok__with__binary_run_secret.ct b/testdata/get__secret__ok__with__binary_run_secret.ct
new file mode 100644
index 0000000..94460bd
--- /dev/null
+++ b/testdata/get__secret__ok__with__binary_run_secret.ct
@@ -0,0 +1,4 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --secret --run --include-binary
+hello world
diff --git a/testdata/get__secret__ok__with__binary_secret.ct b/testdata/get__secret__ok__with__binary_secret.ct
new file mode 100644
index 0000000..943fb74
--- /dev/null
+++ b/testdata/get__secret__ok__with__binary_secret.ct
@@ -0,0 +1,4 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --include-binary --secret
+echo hello world
diff --git a/testdata/get__secret__ok__with__run_secret.ct b/testdata/get__secret__ok__with__run_secret.ct
new file mode 100644
index 0000000..a7ab85a
--- /dev/null
+++ b/testdata/get__secret__ok__with__run_secret.ct
@@ -0,0 +1,4 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --run --secret
+hello world
diff --git a/testdata/get__secret__ok__with__secret.ct b/testdata/get__secret__ok__with__secret.ct
new file mode 100644
index 0000000..1aae59d
--- /dev/null
+++ b/testdata/get__secret__ok__with__secret.ct
@@ -0,0 +1,4 @@
+$ fecho cmd echo hello world
+$ pda set a --secret < cmd
+$ pda get a --secret
+echo hello world