During Quay bootstrap, if debugging is enabled, the validator will print out the database URI exactly as it stands, without obfuscating the password:

time="2024-10-09T14:51:20Z" level=debug msg="Pinging database at postgresql://QUAY_USER:PasswordDB_unencrypted@POSTGRESQL_HOSTNAME/quaydb"

This might be perceived as a security concern. A better option would be to obfuscate the password part during printout.