This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 19f1d581c70 Clarify sensitive data handling in security model (#70424)
19f1d581c70 is described below
commit 19f1d581c7052d6c0bbfdf83928c0205e10e07fc
Author: Bharat Khanna <[email protected]>
AuthorDate: Sun Oct 18 11:02:24 2026 -0700
Clarify sensitive data handling in security model (#70424)
* Clarify sensitive data handling in security model
* Keep log masking in the sensitive information section and fix the
--show-values flag name
Generated-by: Claude Opus 5
---------
Co-authored-by: bharat-khanna <[email protected]>
Co-authored-by: Jarek Potiuk <[email protected]>
---
airflow-core/docs/security/security_model.rst | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/airflow-core/docs/security/security_model.rst
b/airflow-core/docs/security/security_model.rst
index 2ae6144f409..ec5c340851d 100644
--- a/airflow-core/docs/security/security_model.rst
+++ b/airflow-core/docs/security/security_model.rst
@@ -156,12 +156,15 @@ Those users should be highly trusted not to misuse this
capability.
About Sensitive information
...........................
-Sensitive information consists of connection details, variables, and
configuration. In versions later than Airflow 3.0
-sensitive information will not be exposed to users via API, UI, and
``airflowctl``.
-However, ``task-sdk`` still provides access to sensitive information (e.g.,
Use SDK API Client to get
-Variables with task-specific ``JWT`` token). Local CLI will only return keys
except when using ``--show_values``.
-Sensitive information has been masked in logs, UI, and API outputs. In case of
Dag author expose sensitive
-information in other way (e.g., via environment variables), those values will
not be masked.
+Sensitive information consists of connection details, variables, and
configuration. In Airflow 3 and later,
+Airflow masks sensitive information in task logs, the UI, API responses, and
``airflowctl`` output by default.
+Some execution-time channels are still able to retrieve sensitive values when
the caller is already
+authorized to do so, for example ``task-sdk`` can access variables through the
Task Execution API using a
+task-specific ``JWT`` token. The local CLI returns keys by default and only
shows values when
+``--show-values`` is used.
+
+If Dag author code exposes sensitive information in another way (for example
via environment variables),
+those values will not be masked automatically.
Audit log users
...............
