When a workflow webhook node retrieves a dynamic credential (e.g., an OAuth access token) at runtime, the full response including the token is stored in variables.outputs and is permanently visible in the workflow run history UI for up to 90 days. There is currently no way to mark a variable as sensitive so that its value is redacted or masked in the run history display.

This is a security concern for any workflow that must fetch short-lived credentials dynamically, as Port Secrets (the recommended alternative) only support static, non-expiring values.