@emurphy @oceane @pixelfed @dev_m @mcspadden So when someone logs into #Pixelfed, #Cloudflare sees their username, password & all traffic on that site. CF holds the keys so that’s where the tunnel ends. CF users (e.g. Pixelfed) do not warn users of this. So suppose a user is sloppy & reuses the same pw on many websites. CF sees the pw & from that would even be able to compromise that user on non-CF sites.