[tzhenghao]

Hmm why should passwords (hashed or not) be stored in logs though? I don’t see a reason for doing that. You could unset it (and/or other sensitive data) before dumping them into logs.

[Zombieball]

They shouldn’t. It was an unintentional bug

[patrickthebold]

They shouldn't. It was a mistake.

[Leka74]

Probably logging the HTTP/S requests, which included usernames & passwords in plaintext.