Credentials are sent only over this connection's encrypted WebSocket, straight to the backend that opens the SSH session — they are never stored or logged. Only connect to hosts and with credentials you're authorized to use.