We should ensure that when printing the replication traffic, that we redact the secret attributes. The NDR dump output is safer, as these are encrypted, but the ldif is clear text.
Fixed in master with dc48fa982251292a0d46d701c6e912620caf7c72 and in Samba 4.7 with 66de4c1947aa2f4a20c02c65a4b9d0635f947467. *** This bug has been marked as a duplicate of bug 13017 ***