Configuration: an encrypted property value that is not a valid encrypted value is silently "decrypted" to garbage instead of being rejected

Configuration: the error for an undecodable encrypted property echoes the value (e.g. a plain-text password) into the log