Solutionunvalidated
PoC: `wget --xattr -O /tmp/leak.bin 'https://alice:S3cret@example.com/file'` then `getfattr -d /tmp/leak.bin` shows `user.xdg.origin.url="https://alice:S3cret@example.com/file"` — wget v1.12+ with --xattr. Tension: leaks credentials via user.xdg.origin.url. Outcome: Confirmed in repo src tree at v1.19.
0116c148-8a4d-4dfe-83eb-774fb56cf756
PoC: wget --xattr -O /tmp/leak.bin 'https://alice:S3cret@example.com/file' then getfattr -d /tmp/leak.bin shows user.xdg.origin.url="https://alice:S3cret@example.com/file" — wget v1.12+ with --xattr. Tension: leaks credentials via user.xdg.origin.url. Outcome: Confirmed in repo src tree at v1.19.