This question already has an answer here:
Heroku got interesting blog post:
For security reasons, we will be sunsetting support of auth in query string sooner, which we will announce in the Changelog.
However, no explanation is provided about those reasons. So why auth in query string is considered insecure?