Verbatim report from Maksym Mazura via secalert. Impacted project ansible-core, verified on 2.21.5; `exception` listed in PRESERVE in lib/ansible/_internal/_task.py on v2.21.6rc1, v2.22.0rc2 and devel; not reproducible on 2.16.3. Three leak vectors: (1) module arg-validation value echoed, (2) templating Origin snippet of the vars file (failing line + two preceding lines), (3) full fail/assert msg; also under -vvv. INLINE reproducer provided: sec.yml (secret_a !unsafe "FAKEUNSAFE111", secret_b "FAKEPLAIN222 {{ nosuchvar }}"); pb.yml (command echo {{secret_b}}, wait_for port {{secret_a}}, fail msg {{secret_a}} - all no_log:true ignore_errors:true); run: ansible-playbook -i localhost, -c local -e @sec.yml pb.yml. Output on 2.21.5 shows FAKEUNSAFE111 and the secret_b line (plus preceding secret_a line) next to the "censored" notice. Suggested fix: do not preserve `exception` (or replace its message) when the result is censored, as 2.16 did; or have CallbackBase._handle_exception print fixed text for censored results. NOTE: no reproducer file/attachment was attached to the ticket - only the inline steps above; Red Hat has not yet independently reproduced. Disclosure: not public, no bounty requested.