AIKIDO-2026-32037

TL;DR

The Snowflake Python connector writes diagnostic logs that can include authentication tokens, OAuth access and refresh tokens, query result master keys (qrmk), pre signed cloud storage URLs, and SAML assertions. Log redaction misses some log paths and data types, so these secrets reach DEBUG logs, third party library logs (botocore, urllib3), and result batch metadata in cleartext. Anyone who can read those logs can recover valid credentials and decryption keys and reuse them against the Snowflake account or cloud storage. The fix enables default secret masking across connector and third party loggers and strips qrmk and chunk header values from result batch logs.