diff --git a/veilid-core/src/network_manager/wasm/mod.rs b/veilid-core/src/network_manager/wasm/mod.rs
index c9a0c445..b9e66e8c 100644
--- a/veilid-core/src/network_manager/wasm/mod.rs
+++ b/veilid-core/src/network_manager/wasm/mod.rs
@@ -387,7 +387,7 @@ impl Network {
         editor_public_internet.set_network_class(Some(NetworkClass::WebApp));
 
         // commit routing table edits
-        editor_public_internet.commit();
+        editor_public_internet.commit(true).await;
 
         self.inner.lock().network_started = true;
         Ok(())
@@ -414,10 +414,11 @@ impl Network {
         // Drop all dial info
         routing_table
             .edit_routing_domain(RoutingDomain::PublicInternet)
-            .clear_dial_info_details()
+            .clear_dial_info_details(None, None)
             .set_network_class(None)
             .clear_relay_node()
-            .commit();
+            .commit(true)
+            .await;
 
         // Cancels all async background tasks by dropping join handles
         *self.inner.lock() = Self::new_inner();
diff --git a/veilid-core/src/veilid_api/debug.rs b/veilid-core/src/veilid_api/debug.rs
index 3e70cf04..17050629 100644
--- a/veilid-core/src/veilid_api/debug.rs
+++ b/veilid-core/src/veilid_api/debug.rs
@@ -582,17 +582,24 @@ impl VeilidAPI {
     }
 
     async fn debug_config(&self, args: String) -> VeilidAPIResult<String> {
-        let config = self.config()?;
+        let mut args = args.as_str();
+        let mut config = self.config()?;
+        if !args.starts_with("insecure") {
+            config = config.safe_config();
+        } else {
+            args = &args[8..];
+        }
         let args = args.trim_start();
+
         if args.is_empty() {
-            return config.get_key_json("");
+            return config.get_key_json("", true);
         }
         let (arg, rest) = args.split_once(' ').unwrap_or((args, ""));
         let rest = rest.trim_start().to_owned();
 
         // One argument is 'config get'
         if rest.is_empty() {
-            return config.get_key_json(arg);
+            return config.get_key_json(arg, true);
         }
 
         // More than one argument is 'config set'
@@ -1372,7 +1379,7 @@ peerinfo [routingdomain]
 entries [dead|reliable]
 entry <node>
 nodeinfo
-config [configkey [new value]]
+config [insecure] [configkey [new value]]
 txtrecord
 keypair
 purge <buckets|connections|routes>
diff --git a/veilid-core/src/veilid_config.rs b/veilid-core/src/veilid_config.rs
index d8c6d67e..f8a5cf88 100644
--- a/veilid-core/src/veilid_config.rs
+++ b/veilid-core/src/veilid_config.rs
@@ -576,7 +576,7 @@ impl VeilidConfig {
         self.inner.read()
     }
 
-    pub fn safe_config(&self) -> VeilidConfigInner {
+    fn safe_config_inner(&self) -> VeilidConfigInner {
         let mut safe_cfg = self.inner.read().clone();
 
         // Remove secrets
@@ -587,6 +587,20 @@ impl VeilidConfig {
         safe_cfg
     }
 
+    pub fn safe_config(&self) -> VeilidConfig {
+        let mut safe_cfg = self.inner.read().clone();
+
+        // Remove secrets
+        safe_cfg.network.routing_table.node_id_secret = TypedSecretGroup::new();
+        safe_cfg.protected_store.device_encryption_key_password = "".to_owned();
+        safe_cfg.protected_store.new_device_encryption_key_password = None;
+
+        VeilidConfig {
+            update_cb: self.update_cb.clone(),
+            inner: Arc::new(RwLock::new(safe_cfg)),
+        }
+    }
+
     pub fn with_mut<F, R>(&self, f: F) -> VeilidAPIResult<R>
     where
         F: FnOnce(&mut VeilidConfigInner) -> VeilidAPIResult<R>,
@@ -611,14 +625,14 @@ impl VeilidConfig {
 
         // Send configuration update to clients
         if let Some(update_cb) = &self.update_cb {
-            let safe_cfg = self.safe_config();
+            let safe_cfg = self.safe_config_inner();
             update_cb(VeilidUpdate::Config(VeilidStateConfig { config: safe_cfg }));
         }
 
         Ok(out)
     }
 
-    pub fn get_key_json(&self, key: &str) -> VeilidAPIResult<String> {
+    pub fn get_key_json(&self, key: &str, pretty: bool) -> VeilidAPIResult<String> {
         let c = self.get();
 
         // Generate json from whole config
@@ -627,7 +641,11 @@ impl VeilidConfig {
 
         // Find requested subkey
         if key.is_empty() {
-            Ok(jvc.to_string())
+            Ok(if pretty {
+                jvc.pretty(2)
+            } else {
+                jvc.to_string()
+            })
         } else {
             // Split key into path parts
             let keypath: Vec<&str> = key.split('.').collect();
@@ -638,7 +656,11 @@ impl VeilidConfig {
                 }
                 out = &out[k];
             }
-            Ok(out.to_string())
+            Ok(if pretty {
+                out.pretty(2)
+            } else {
+                out.to_string()
+            })
         }
     }
     pub fn set_key_json(&self, key: &str, value: &str) -> VeilidAPIResult<()> {