GHSA-4rh7-jwg9-m28m

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

### Summary Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes. ### Affected Code ```python # openssl_encrypt_server/modules/keyserver/routes.py:214-215 # openssl_encrypt_server/modules/telemetry/routes.py:90-91 async def refresh_token( request: Request, refresh_token: str = Query(..., description="Refresh token") ): ``` ### Impact Tokens in URL query parameters are exposed in: - Server access logs - Proxy/CDN logs - Browser history - HTTP Referer headers - Network monitoring tools This creates significant token leakage risk. ### Recommended Fix - Accept refresh tokens in the request body (POST) instead of query parameters - Use `Body(...)` instead of `Query(...)` ### Fix Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.