@0xF21D HTTP only, opt-in.
You can (should) do this at home.

“Once enabled, leaked credentials detection will scan incoming HTTP requests for known authentication patterns…”