Security vulnerability affects the airflow-3 package. The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so the key-based should hide value for key check (which triggers on secret-suffixed key names like * password / * token / * secret) could not fire for JSON-decodable variable values.