GHSA-4rh7-jwg9-m28m openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

• PyPI openssl-encrypt: < 1.4.0 → fixed in 1.4.0

Summary Refresh tokens are accepted as URL query parameters in the keyserver and telemetry server routes. Affected Code ```python openssl_encrypt_server/modules/keyserver/routes.py:214-215 openssl_encrypt_server/modules/telemetry/routes.py:90-91 async def refresh_token( request: Request, refresh_token: str = Query(..., description="Refresh token") ): ``` Impact Tokens in URL query parameters are exposed in: • Server access logs • Proxy/CDN logs • Browser history • HTTP Referer headers • Network monitoring tools This creates significant token leakage risk. Recommended Fix • Accept refresh tokens in the request body (POST) instead of query parameters • Use `Body(...)` instead of `Query(...)` Fix Fixed in commit `4b2adb0` on branch `releases/1.4.x` — moved refresh token from Query parameter to POST body via RefreshRequest Pydantic model.