The vulnerability stemmed from credential-containing configuration files being written to build logs without masking. The key functions are the content supply methods in ConfigProvider and its implementations (AbstractCustomProvider/AbstractMavenSettingsProvider), which provided credential-embedded content but did not implement the mechanism to identify sensitive strings for masking. The patch added getSensitiveContentForMasking to collect credentials and a ConsoleLogFilter to mask them, confirming these functions were the root cause. The ConfigFileBuildWrapper's lack of masking decorator in older versions further corroborates this analysis.