The "save-survey" function creates a critical security vulnerability, potentially exposing personal passwords of ordinary survey-takers.

First, recognize that self-hosted surveys are often hosted under the same domains of survey takers. Second, recognize that modern browsers increasingly attempt to autofill usernames and passwords in conjunction with anything on a form page that looked like a username or password.

The save-function on a survey prompts the user for a username, password, and email address. In most use-cases, the user will be prompted by the browser to submit an already existing password which is valid for the same domain. This password is then (1) passed plaintext (via POST) to the server, (2) stored for a period of time in the survey database, (3) sent to the user's email address (without email verification, thus possibly bouncing to an admin or worse -- see issue 9606), (4) in plaintext of the URL which is saved in the logs.

If I could SCREAM about this, I would.