If JSP applications are running on the SAP MI Client Component, the SAP MI Client Component will contain a small Web server with a configurable log function.
INFORMATION or DEBUG must not be set as verbosity level for the Jasper log function. If it is, the user password could be logged on the client side. The default setting is FATAL. You can check the configuration in file <Installation directory of the SAP MI client component>\conf\server.xml and adjust it if necessary.