Oh wow, it posts your cleartext email credentials to an API endpoint called “/ows/beta/ShadowService/getShadowToken”.

But it least it calls the password string a “Secret” in the JSON payload so you can REST assured knowing the Shadow Service agents will handle this data appropriately.