The information that C3P0 logs at statrtup is IMHO a security issue.

The later versions of c3p0 (0.9) allow you to turn this off by changing
the log4j settings:


  log4j.logger.com.mchange.v2.c3p0=warn