It depends on the implementation. If they’re bad at security and only redacting it on the UI level, someone could just open inspector and get it. I would really hope no one is doing that these days, though. There may be other APIs they could exploit with your credentials to get that information as well, if it’s not redacted across all APIs.