Leak of sensitive values to Airflow rendered template

I’m just getting started with Airflow, but seem to have got into a situation where sensitive values (e.g. connection passwords) end up in my task’s rendered template. Here’s how my DAG starts, having set up a connection called “secret” with a password specified:

     t1 = BashOperator( 

        task_id="masked-in-rendered-template", 

        bash_command="echo {{ conn.secret.password }}", 

    ) 
        

    t2 = BashOperator( 

        task_id="not-masked-in-rendered-template", 

        depends_on_past=True, 

        bash_command="echo {{ …