Most of developers are aware that username or password are PII and if they log it they are likely to get fired. Meanwhile our HTTP servers happily log every UR

Most of developers are aware that username or password are PII and if they log it they are likely to get fired. Meanwhile our HTTP servers happily log every URI it received in access logs. Oh, and if you ever send a link in non E2EE messenger it's likely their server generated the link preview for you.