SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
"https://github.com/pypa/advisory-database/blob/main/vulns/sickrage/PYSEC-2018-101.yaml"