diff --git a/pkg/sessionctx/variable/session.go b/pkg/sessionctx/variable/session.go
index c4bb81ee8d6ff..6c212c7c77fd0 100644
--- a/pkg/sessionctx/variable/session.go
+++ b/pkg/sessionctx/variable/session.go
@@ -2045,6 +2045,7 @@ func NewSessionVars(hctx HookContext) *SessionVars {
 		ResourceGroupName:             resourcegroup.DefaultResourceGroupName,
 		DefaultCollationForUTF8MB4:    mysql.DefaultCollationName,
 		GroupConcatMaxLen:             DefGroupConcatMaxLen,
+		EnableRedactLog:               DefTiDBRedactLog,
 	}
 	vars.status.Store(uint32(mysql.ServerStatusAutocommit))
 	vars.StmtCtx.ResourceGroupName = resourcegroup.DefaultResourceGroupName
diff --git a/pkg/util/redact/BUILD.bazel b/pkg/util/redact/BUILD.bazel
index efc000e401a2d..18c8b3c2c2cc7 100644
--- a/pkg/util/redact/BUILD.bazel
+++ b/pkg/util/redact/BUILD.bazel
@@ -5,7 +5,10 @@ go_library(
     srcs = ["redact.go"],
     importpath = "github.com/pingcap/tidb/pkg/util/redact",
     visibility = ["//visibility:public"],
-    deps = ["@com_github_pingcap_errors//:errors"],
+    deps = [
+        "//pkg/util/intest",
+        "@com_github_pingcap_errors//:errors",
+    ],
 )
 
 go_test(
diff --git a/pkg/util/redact/redact.go b/pkg/util/redact/redact.go
index ef2f6c02a00f8..4cfb5dfd9c1ba 100644
--- a/pkg/util/redact/redact.go
+++ b/pkg/util/redact/redact.go
@@ -25,6 +25,7 @@ import (
 	"strings"
 
 	"github.com/pingcap/errors"
+	"github.com/pingcap/tidb/pkg/util/intest"
 )
 
 var (
@@ -50,7 +51,11 @@ func String(mode string, input string) string {
 		return b.String()
 	case "OFF":
 		return input
+	case "ON":
+		return ""
 	default:
+		// should never happen
+		intest.Assert(false, "invalid redact mode")
 		return ""
 	}
 }