Bubble's run-mode engine preloads all images it can find in your app for performance reasons — including images that are conditionally hidden or behind visibility conditions. If any of those images are hosted at a password-protected URL, the browser will prompt for credentials when the page loads, even if the image would never be visible to that user.
What you might notice
A password prompt appears when your app loads, even though no protected content is visible on the page
The prompt is triggered by an image that's only supposed to appear under certain conditions
Workaround
Use images from a publicly accessible source, or upload files through Bubble's file uploader and control visibility with conditions. Avoid using password-protected URLs as image sources. You can read more in the documentation.