community.general's ipa_getkeytab module (plugins/modules/ipa_getkeytab.py) declares its bind_pw argument WITHOUT no_log:

      bind_dn=dict(type="str"),
      bind_pw=dict(type="str"),                 # missing no_log
      password=dict(type="str", no_log=True),   # sibling has it

Because the value is neither flagged with no_log nor caught by
ansible-core's name-based redaction heuristic, the IPA simple-bind
password is disclosed through several channels.

Exposure vectors
----------------
  1. Log disclosure (CWE-532): the value appears in cleartext in the target host's journal/syslog "Invoked with" line, in the module's return values / -v output, and in Automation Controller / AWX job output.
  2. Process-list disclosure (CWE-214): the module passes the password to the child helper as `ipa-getkeytab ... --bindpw <cleartext> ...` (bind_pw=cmd_runner_fmt.as_opt_val("--bindpw")), so it is visible in      `ps` / /proc/<pid>/cmdline to local users during execution. This vector is the child process's own argv and is NOT remediated by no_log.
  3. Contributing cleartext storage (CWE-312).

  Why automatic redaction does not apply
  --------------------------------------
  ansible-core's name-based safety net is PASSWORD_MATCH in
lib/ansible/module_utils/basic.py (not parameters.py). Its regex requires a literal "pass" substring:

      ^(?:.+[-_\s])?pass(?:[-_\s]?(?:word|phrase|wrd|wd)?)(?:[-_\s].+)?$

"bind_pw" / "bindpw" contain no "pass" substring, so the pattern does not match: no warning and no auto-redaction. Even when PASSWORD_MATCH does match a name, it only substitutes 'NOT_LOGGING_PASSWORD' in the "Invoked with" line and emits a warning — it does not add the value to no_log_values, so return values and other logging remain unredacted. Explicit no_log=True in the argument spec is therefore the required fix.