Chart-rendered Secrets in the dashboard's "Sync and plan" view show
+ Error parsing new secret: error unmarshaling JSON: while decoding JSON: illegal base64 data at input byte 8
instead of the redacted diff (seen on every helm component deploy in the lovable-enterprise azure install).

Cause: helm-diff's redactSecrets mutates the manifest maps in place — it rewrites each Secret's data: values to REDACTED # (n bytes) / ++++++++ # (n bytes). getDiff runs two passes (diff, then diffReport) over the same map[string]*manifest.MappingResult, so the second pass re-parses already-redacted content: both placeholders are 8 valid base64 chars followed by a space, hence the constant "byte 8" failure, and the fork replaces the whole Secret with the parse error. Upstream never hits this because the CLI does a single pass.

Fix: give each pass its own shallow copy of the maps.