community.general's ipagetkeytab module (plugins/modules/ipagetkeytab.py) declares its bindpw argument WITHOUT nolog:

binddn=dict(type="str"), bindpw=dict(type="str"), # missing nolog password=dict(type="str", nolog=True), # sibling has it

Because the value is neither flagged with nolog nor caught by ansible-core's name-based redaction heuristic, the IPA simple-bind password is disclosed through several channels.

Exposure vectors ---------------- 1. Log disclosure (CWE-532): the value appears in cleartext in the target host's journal/syslog "Invoked with" line, in the module's return values / -v output, and in Automation Controller / AWX job output. 2. Process-list disclosure (CWE-214): the module passes the password to the child helper as ipa-getkeytab ... --bindpw <cleartext> ... (bindpw=cmdrunnerfmt.asoptval("--bindpw")), so it is visible in ps / /proc/<pid>/cmdline to local users during execution. This vector is the child process's own argv and is NOT remediated by nolog. 3. Contributing cleartext storage (CWE-312).

Why automatic redaction does not apply -------------------------------------- ansible-core's name-based safety net is PASSWORDMATCH in lib/ansible/moduleutils/basic.py (not parameters.py). Its regex requires a literal "pass" substring:

^(?:.+[-\s])?pass(?:[-\s]?(?:word|phrase|wrd|wd)?)(?:[-\s].+)?$

"bindpw" / "bindpw" contain no "pass" substring, so the pattern does not match: no warning and no auto-redaction. Even when PASSWORDMATCH does match a name, it only substitutes 'NOTLOGGINGPASSWORD' in the "Invoked with" line and emits a warning — it does not add the value to nologvalues, so return values and other logging remain unredacted. Explicit nolog=True in the argument spec is therefore the required fix.