docs: Clarify that masking in Connection extra JSON is keyword-dependent #58587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking "Sign up for GitHub", you agree to our terms of service and privacy statement. We'll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Nov 26, 2025

Merged

Changes from all commits

Commits

Select commit

File filter

Conversations

Jump to

Jump to file

Failed to load files.

6 changes: 4 additions & 2 deletions airflow-core/docs/security/secrets/mask-sensitive-values.rst

Show comments

Original file line number	Diff line number	Diff line change
Expand Up		@@ -20,8 +20,10 @@
		Masking sensitive data
		----------------------

		Airflow will by default mask Connection passwords and sensitive Variables and keys from a Connection's
		extra (JSON) field when they appear in Task logs, in the Variable and in the Rendered fields views of the UI.
		Airflow will by default mask Connection passwords, sensitive Variables, and keys from a Connection's
		extra (JSON) field whose names contain one or more of the sensitive keywords when they appear in Task logs,
		in the Variables UI, and in the Rendered fields views of the UI. Keys in the extra JSON that do not include
		any of these sensitive keywords will not be redacted automatically.

		It does this by looking for the specific value appearing anywhere in your output. This means that if you
		have a connection with a password of ``a``, then every instance of the letter a in your logs will be replaced
Expand Down

Navigation Menu