Can you just set the expose="true" to "false" before I merge?
The expose attribute means this parameter value can be sent over to the clients (through the registry), which would be in that case a security problem I think.