Credentials in Repository Settings for Pull requests are exposed
The Pull URL is hidden where specified on the settings screen. However on the Remote Sync screen, the URL is masked, but clearly visible when hovering the cursor over the masked URL, as well as obviously being visible in the page source. Makes the masking a little pointless, unless the idea is to avoid the person reading over your shoulder?!