> The main point I think is, that GET Requests are logged in log-files which are usually accessible by more people that the main database.
This is an outright assumption, and it's a bad one.
This is a non-issue, because they do NOT log these requests, and it's https.
So move on, this is just noise.