Yup. There’s a reason putting credentials into url parameters is considered dangerous.

Well-chosen passwords stored properly are always private. Passwords also tend to have much longer lifetimes than links.