I have a more restricted use case, which is to proxy images from Phabricator-hosted Git repositories. For example, I'd like README.md in a repo to be able to reference images in the repo. without having to upload them as files.

In T9966#148595, @epriestley wrote:

So you haven't actually reproduced this yourself? Is it possible that the user mistook xxxxx as uncensored credentials? Can you try reproducing it directly?

I can't reproduce this locally even with a username email.

In T9966#148590, @epriestley wrote:

In your report, you say <user email address> -- is the login username for this user a string including "@"? Does the UI print out a message like this?

https://xxxxx@domain.com:password@remote.example.com/...

..that is, the beginning of the email address is censored, but the rest of it is not and the password and domain are not? Or is the HTTP username not really an email address?

I should note that we're running the latest version of Git (2.6.3) which could be the culprit. From my superficial inspection of the code, it appears that the output of git fetch is simply reflected.