pip shows password in index-url in the "Downloading <url>" message

[pradyunsg]

I also found that pip doesn't always redacts the password. If you change the credentials to "valid" ones, then after doing pip install you get e.g.

$ pip install https://foo:bar@github.com/slafs
Collecting https://foo:****@github.com/slafs
  Downloading https://foo:bar@github.com/slafs
...

😅

Originally posted by @slafs in #6775 (comment)

[xavfernandez]

Cf #5773 for inspiration

[SharatChandar]

Can i try this ?

[pradyunsg]

@SharatChandar I feel it would be best to work on one issue at a time. :)

[SharatChandar]

@pradyunsg Sure bro. Sorry.

[YoloSecurity]

I'd love to give this one a go - it'd be my first though!

[pradyunsg]

@YoloSecurity Please feel free to. :)

[YoloSecurity]

@pradyunsg Had a go at making a fix and PR - first PR I've ever done though so feedback welcomed!