On a normal site that's Cloudflare'd, if there is a login form, your password will be visible in plaintext as the data is decrypted by Cloudflare since their reverse-proxying service is effectively a MitM. This poses a minor OpSec issue if your threat model includes Cloudflare as a threat actor. But, what's cool is if the site has a Nostr login, you don't need to worry about this type of possible attack vector. Nostr is the future of the interoperable and open web.