That's true and great point. Let's play devil. You can't really be sure if Google engineer is sloppy and logging username and password on entry and then the SRE

That's true and great point. Let's play devil. You can't really be sure if Google engineer is sloppy and logging username and password on entry and then the SRE reading the log sees everything. I am not sure if their build system has plugin to detect such big red flag. Stacktrace is another place with potential leak of credentials. All of these are reasons when someone claims software is open source and auditable but they run the service themselves, it's really important to note you can't audit the actual server. They can log your username and password behind the scene while the client side appears to be 100% the same as the one on the server side. What you describe is not rare, can be done with cross-site scripting. How it happens depends on the injection method (perhaps SQL injection).