Hi all, I've opened a small PR that adds opt-in content-pattern detection to SecretsMasker so that values matching well-known credential formats get redacted even when they weren't registered ahead of time via mask_secret():
https://github.com/apache/airflow/pull/70956 Airflow's SecretsMasker redacts by key name today. Values passed via XCom, or through Connection extras whose keys don't match a sensitive keyword, are not redacted -- as noted in the docs (security/secrets/mask-sensitive-values.rst) and captured in issue #58514, which was closed as a docs-only clarification without the underlying gap being addressed. Users still leak credentials this way by printing environment variables during debugging or logging stack traces that include a token or PEM block. The PR adds a curated set of well-known credential formats -- AWS access keys, GitHub / Slack / Google / Stripe tokens, PEM private-key blocks, JWTs. Every pattern has a distinctive fixed prefix (very low false-positive rate) and bounded quantifiers (no ReDoS surface, reviewed against the same class of issue recently fixed in #70716). Off by default via a new [core] mask_secrets_content_patterns config option, so no existing deployment changes behavior. Six-file diff, +341/-3, tests and docs included. Would especially value feedback on the initial pattern set and on the widened log-filter short-circuit. Thanks, Deepak Kumar
