Changes to information such as passwords, secret keys etc should be audited without saving the sensitive value itself.
Currently we have workarounds in place in several places in foreman core. This should be fixed in the audited gem, opened https://github.com/collectiveidea/audited/pull/339 for that. Once that is merged we should leverage the gem solution to replace all workarounds we use.