Why is the title misleading? Bitwarden leaked my password for subdomain A to subdomain B and does this even if auto-fill is set to off. That is exactly what the title says.

In my case even plaintext, because subdomain B has no HTTPS.