[BUG] - Sensitive authentication credentials exposed in plaintext @ConfigurationProperties

[dyingman1]

Describe the bug
PulsarProperties.java stores sensitive authentication material (JWT tokens, TLS private key paths, OAuth2 URLs, trust store passwords) as plaintext @ConfigurationProperties fields without masking or encryption. These are exposed via Spring Boot Actuator's /actuator/env endpoint when enabled.

The project depends on spring-boot-starter-actuator and micrometer-registry-prometheus (see pom.xml lines 39-45) but has NO spring-boot-starter-security dependency, leaving actuator endpoints publicly accessible.

To Reproduce
Steps to reproduce the behaviour:

1. Start the application with actuator enabled (default).

2. Access:

GET /actuator/env

3. Response includes all configuration properties in plaintext:

{
  "propertySources": [{
    "name": "application.yml",
    "properties": {
      "pulsar.token-auth-value": {
        "value": "eyJhbGciOiJIUzI1NiJ9...",
        "origin": "application.yml - line 5"
      },
      "pulsar.tls-trust-store-password": {
        "value": "changeit",
        "origin": "application.yml - line 8"
      }
    }
  }]
}

Expected behaviour

1. Sensitive @ConfigurationProperties fields should not be exposed via /actuator/env.
2. Spring Boot provides management.endpoint.env.keys-to-sanitize to mask sensitive properties.
3. Consider adding spring-boot-starter-security and restricting actuator endpoint exposure.

Additional context

• CWE-312: Cleartext Storage of Sensitive Information
• CWE-522: Insufficiently Protected Credentials
• Combined with SSRF vulnerability (Producer implementation #1), an attacker can read the config file directly via file:// scheme if the application stores these values in a local file