Securing data pipelines by hiding sensitive information is a key topic in any platform. It is achieved using Databricks Secrets for runtime code configurations etc. Sensitive information storage is to be avoided completely in notebooks.
Can Run Inherently Granting View Access
In Databricks, the Can Run permission inherently includes the ability to view the notebook contents by design
When a user executes a notebook, visibility into that code is required for several critical reasons as below
Debugging and Troubleshooting - Users must be able to see error messages, stack traces and execution outputs to verify why a job succeeded or failed.
Understanding Execution Context - Users need to know exactly what logic is processing their data to validate behavior and ensure data integrity.
Preventing Black Box Pipelines - Allowing execution without visibility creates an environment where code is impossible to debug, audit or to understand. This creates operational bottlenecks in data workflows.
Hiding Configurations with Databricks Secrets
When you need to protect credentials, API keys or sensitive connection strings, the native and secure approach is to abstract them out of the notebook entirely using a Databricks Secret Scope. You store the sensitive values in a secure vault (AKS/AWS Secret Managers etc) rather than hardcoding them into a cell in the notebook. When you reference these secrets in your code using dbutils.secrets.get(), Databricks automatically redacts the actual values from the notebook outputs. Users can execute the notebook and run the necessary logic, but the plaintext secrets remain completely hidden from view even in the execution logs or display outputs.
For protecting sensitive business logic rather than just credentials, you can encapsulate that code inside Unity Catalog Functions & use RLS/CLS/ABAC (users granted relevant privileges without seeing the implementation) or run workflows as a Service Principal.
By separating your secure configurations (via Secrets) from your execution logic (the Notebook), you can maintain transparent, easily debuggable pipelines without compromising on security.
