In JetBrains UpSource versions prior to 2018.2 build 1293, there is credential disclosure via RPC commands.
jetbrains upsource 2018.2
jetbrains teamcity
jetbrains upsource