The Quay config-tool's GitLab OAuth validator in pkg/lib/shared/validators.go (line 804) places client_id and client_secret as plaintext URL querystring parameters when making POST requests to the configured GitLab endpoint. This causes credentials to leak into server access logs, reverse proxy logs, WAF logs, CDN logs, and OpenTelemetry traces even when the endpoint is the legitimate gitlab.com. The GitHub OAuth validator correctly uses HTTP Basic Auth headers and is not affected.