Location: src/main/java/com/autotune/analyzer/services/ListDatasources.java:110

CWE: CWE-522

What it is: ListDatasources serializes DataSourceInfo (incl. AuthenticationConfig rebuilt from the plaintext kruize_authentication table) with a default Gson — no ExclusionStrategy, Gson serializes private fields by runtime type: BasicAuth password, bearer token, API key, OAuth2 clientSecret all emitted.

Why it's a security flaw: curl http://kruize:8080/datasources -> datasources[].authentication.credentials — network access to Kruize becomes authenticated access to the monitoring stack.

Triage: HIGH stands: end-to-end Gson trace confirmed (no exclusions anywhere on the graph; all five credential subclasses emit); cluster-internal-only assumption REFUTED by the tree's own manifests (NodePort/LoadBalancer services + documented OpenShift Route). Sole serialization endpoint verified. Patched with a Credentials exclusion strategy; compile PASS.

Remediation: ExclusionStrategy/redaction on serialization; never serialize credentials outbound.