I guess we're both having a bad day. Let's break down the original statement: > git clone https://username:password@github.com/.. https://username:password@git

I guess we're both having a bad day. Let's break down the original statement: > git clone https://username:password@github.com/.. https://username:password@github.com/... This command produces a new git repository by cloning the supplied URL > will end up in git reflog The newly generated repository's reflog will contain the credentials passed on the command line. > so yes, it's a problem Assuming the newly generated repository also happens to be a static HTTP server root, which is the subject of the thread in which you've been posting