This sounds like an obvious security issue that had probably been spotted before, but I haven’t found reports of it anywhere, so here we go.
I’ve been setting up SonarQube Community Edition 10.3.0 from Docker (tag sonarqube:10.3.0-community) with settings encryption enabled. When testing the feature, I’ve noticed that the values to encrypt are passed to the encrypt API endpoint as URI parameters, and, as a result, they are logged by the webserver (and also the HTTPS proxy, which I had in my deployment). My screenshot shows offending logs and the browser request:
This kind of defeats the purpose of the encryption feature. It should be easily fixed by passing the values in the request body (which is not logged) instead of the URI. I guess as a workaround you could clear the logs of all web servers the encryption request touches, every time you use it.