This is a neat workaround but introduces unnecessary risk and really should be a proper features of BW. If someone forgets to set “never” for the match type on the url for the fav icon they could potentially leak credentials. Love that you found this but hate that it’s a thing. 