Sensitive runtime values in Keycloak (up to version 26.0.2) are captured during the build process as default values embedded in bytecode, potentially exposing them during runtime. Affected options include those with the "kc" prefix, SPI runtime options, and Quarkus properties. Environment variables set directly in Keycloak 26 or indirectly in all versions expand unconditionally due to PropertyMapper logic, embedding sensitive data into the bytecode. This unintentional behavior risks sensitive information exposure in production builds.