diff --git a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java
index a031592ef9..40786375db 100644
--- a/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java
+++ b/spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java
@@ -45,8 +45,8 @@ public class Sanitizer {
 	private static final String[] REGEX_PARTS = { "*", "$", "^", "+" };
 
 	private static final Set<String> DEFAULT_KEYS_TO_SANITIZE = new LinkedHashSet<>(
-			Arrays.asList("password", "secret", "key", "token", ".*credentials.*", "vcap_services", "sun.java.command",
-					"^spring[\\._]application[\\\\._]json$"));
+			Arrays.asList("password", "secret", "key", "token", ".*credentials.*", "vcap_services",
+					"^vcap\\.services.*$", "sun.java.command", "^spring[\\._]application[\\\\._]json$"));
 
 	private static final Set<String> URI_USERINFO_KEYS = new LinkedHashSet<>(
 			Arrays.asList("uri", "uris", "address", "addresses"));
diff --git a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java
index 0d567da6c6..425bc70a93 100644
--- a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java
+++ b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java
@@ -48,6 +48,8 @@ class SanitizerTests {
 		assertThat(sanitizer.sanitize("sun.java.command", "--spring.redis.password=pa55w0rd")).isEqualTo("******");
 		assertThat(sanitizer.sanitize("SPRING_APPLICATION_JSON", "{password:123}")).isEqualTo("******");
 		assertThat(sanitizer.sanitize("spring.application.json", "{password:123}")).isEqualTo("******");
+		assertThat(sanitizer.sanitize("VCAP_SERVICES", "{json}")).isEqualTo("******");
+		assertThat(sanitizer.sanitize("vcap.services.db.codeword", "secret")).isEqualTo("******");
 	}
 
 	@ParameterizedTest(name = "key = {0}")