AIKIDO-2026-445361

TL;DR

AshPaperTrail can redact or drop attributes marked sensitive? before writing an audit version record. Before the fix the redaction logic only inspected top-level attributes and arguments, so sensitive values nested inside embedded resources, maps, unions, or lists were written verbatim into the version changes and version_action_inputs columns. Applications that relied on sensitive_attributes to protect nested secrets stored them in cleartext in tables that usually have broader read access and longer retention than the source records. The fix recursively redacts sensitive fields in nested values across changes, snapshots, and action inputs.