There is no functionality that does anything with usernames and/or passwords as url parameters. Additionally, we never change the url you entered, which means that if there are any parameters, you either typed them in yourself, clicked on a link already containing them, or a 3rd party application/browser extension mangled with it.
Just to check: are you talking about our Dominion Online application at https://dominion.games ? What exactly does the suspicious url look like? What browser are you using, and do you have any extensions installed that might affect something like this?
Just to check: are you talking about our Dominion Online application at https://dominion.games ? What exactly does the suspicious url look like? What browser are you using, and do you have any extensions installed that might affect something like this?