Credentials and personal data never travel in the URL: every form that sends a password, a token or personal data uses an explicit POST (or a server action), and no code reads credentials from the query string or logs them

Pinned as it read in catalog v3.25.0 — the current version of this rule may read differently, see CH-SEC-034.