The diagnostic lines an edge node writes for blocked requests used to contain the whole request URI, query string included, so a token or an e-mail address in the URL could end up in the node's process log. They now keep the path and only the names of the query parameters: /login?token=secret&email=a@b.c is written as /login?token=…&email=…. Those lines never left the node and were deleted with the containers this version replaced.
Security events were not affected: their path has never carried the query string, and it still does not. When the WAF blocks, challenges or logs a request because of a parameter, the event message now names the parameter it matched, never its value: Blocked by pipeline scoring (ARGS:token). What we store is listed in Trust and security.