title: System.getenv() used in spring boot is shown as a security vulnerability in sonarQube
body: <p>I have method in my spring boot application which takes the data from system environment variable, the method works as intended but sonarQube says "Make sure that environment variables are used safely here",
  I tried to find an alternative to fix this issue but I am unable to find a solution, here is the method:</p>
  
  <p>How can I handle this security issue, I cannot use anything other than getting the values from environment variables.</p>
  
  <pre><code>public Map&lt;String, Object&gt; getConfigurations() {
      Map&lt;String, Object&gt; result = new HashMap&lt;&gt;();
      HttpResponse response = null;
      try {
           String xVaultToken = System.getenv("XVaultToken");
           String cityAppConfig = System.getenv("CityApp_Config");
  
          @SuppressWarnings("deprecation")
          HttpClient client = HttpClients.custom().setSSLHostnameVerifier(new NoopHostnameVerifier())
                  .setSslcontext(
                          new SSLContextBuilder().loadTrustMaterial(null, (x509Certificates, s) -&gt; true).build())
                  .build();
          Map&lt;String, Object&gt; headerDatas = new HashMap&lt;&gt;();
          headerDatas.put("Content-Type", "application/json");
          headerDatas.put("X-Vault-Token", xVaultToken);
          HttpGet get = new HttpGet(cityAppConfig);
          Set&lt;String&gt; keys = headerDatas.keySet();
          for (String key : keys) {
              get.setHeader(key, headerDatas.get(key).toString());
          }
          response = client.execute(get);
          try(BufferedReader rd = new BufferedReader(new InputStreamReader(response.getEntity().getContent()))){
              String responseData = rd.readLine();
              result.put(Constants.RESPONSE, responseData);
          }
          int statusCode = response.getStatusLine().getStatusCode();
          result.put(Constants.STATUS, statusCode);
  
      } catch (Exception e) {
          logger.info("error is local settings getConfigurations" + e);
      }
      return result;
  }
  </code></pre>
  
  <p>}</p>