Fix /debugging/config/dump may leak sensitive information if there are second level properties in the configuration.

[wankai123]

• If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #.
• Update the CHANGES log.

[Copilot]

Pull request overview

This PR fixes a security issue where the /debugging/config/dump endpoint could leak sensitive information when configuration properties contain nested (second-level) Properties objects. Previously, only top-level property values were iterated and masked; nested Properties values were dumped as raw Properties.toString() output without masking.

Changes:

• Added handling for nested Properties values in dumpBootingConfigurations, flattening them into dot-separated keys and applying masking individually.
• Extracted the masking logic into a reusable maskConfigValue method with proper Javadoc.
• Updated the changelog to document the fix.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
oap-server/server-core/src/main/java/org/apache/skywalking/oap/server/core/status/ServerStatusService.java	Handles nested Properties in config dump, extracts masking into a helper method
docs/en/changes/changes.md	Adds changelog entry for the fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.