[AIRFLOW-3165] Document interpolation of '%' and warn (apache#4007)

Author: bolkedebruin

docs/security.rst

@@ -10,6 +10,12 @@ backends or creating your own.
 
 Be sure to checkout :doc:`api` for securing the API.
 
+.. note::
+
+   Airflow uses the config parser of Python. This config parser interpolates '%'-signs.
+   Make sure not to have those in your passwords if they do not make sense, otherwise
+   Airflow might leak these passwords on a config parser exception to a log.
+
 Web Authentication
 ------------------