When you `git fetch` or `git clone` a remote repository, some of the error messages include the remote URI. For authenticated HTTP/HTTPS repositories, this URI has credentials.
We should probably make an effort to censor these credentials. I don't think we need to be hugely comprehensive about it, but we could try to clobber credentials out of URIs in the fetch/pull remote ops in git/hg, at least.
(We already do a lot of work to keep them from appearing in commands.)