Never hardcode passwords in DAG code.
Use:
- Airflow Connections
- Environment variables
- Secret backends / cloud secret managers (AWS Secrets Manager, GCP Secret Manager, Vault, Azure Key Vault)
A Secret Backend retrieves secrets from an external secure system instead of storing them in plain config or Git.