I recently wanted to send a Debug-Log of Davx5 to my Mail Provider and noticed that the Logs contained the "Authorization: Basic"-Header with the real value, e.g. my Password masked in Base64.

Imho this Header (and other Password related info) should not be logged, an inexperienced User would never notice it (since its Base-64-Gibberish) and might then post the Log online.
Or at least, activating the log should give you a warning, that the log might contain the Password.