Fix: Consumer PII transits and is logged in plaintext: TLS disabled on the production datasource and SQL statement logging enabled

[WesternConcrete]

Summary

Finding: Consumer PII transits and is logged in plaintext: TLS disabled on the production datasource and SQL statement logging enabled (NS terms / data-handling gap) in COG-GTM/ftgo-monolith.

ftgo-application/src/main/resources/application.properties shipped useSSL=false&allowPublicKeyRetrieval=true on the datasource carrying consumer names and delivery addresses, and logging.level.org.hibernate.SQL=DEBUG, duplicating that data into the application log stream (a broader access/retention boundary than the DB).

Fix approach: require TLS on the JDBC connection (sslMode=REQUIRED, dropping allowPublicKeyRetrieval) in both the app config and the docker-compose.yml override, and drop SQL/bind-parameter logging to WARN; credentials now read from SPRING_DATASOURCE_USERNAME/SPRING_DATASOURCE_PASSWORD with the existing local values as fallback.

Link to Devin session: https://app.devin.ai/sessions/77249313a8fd4c14b8ebc931630a71f3
Open in Devin Desktop: https://app.devin.ai/desktop/session/77249313a8fd4c14b8ebc931630a71f3?variant=devin
Requested by: @WesternConcrete

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring