Credentials from replication are "exposed" in status

So I started replication with the following command:

curl -X POST http://127.0.0.1/_replicate \
-d '

{"source":"http://till:foo@127.0.0.1/bar", "target":"http://till:bar@example.org/bar"}

'

And now my status window displays:
3467ef: http://till:foo@127.0.0.1/bar/ -> http://till:bar@example.org/bar/

I'd like to see the credentials stripped from display and replaced with XXX or *** to show that auth was used.