What's the safest way of passing basic auth credentials into a user event for an https request? I, for obvious reasons, don't want to hardcode the username and password into the script and then commit the sdf project to github and stuff

You can add parameters to the script record and then add the credentials to the deployment using those parameters. Then you'd only see the runtime request to get the credentials in the script.

I doubt there is a better way. I totally forgot about the parameters functionality for scripts

if you want a setup where only NetSuite has access to the password, then use a credential field (https://system.na1.netsuite.com/app/help/helpcenter.nl?fid=section_4418229131.html&whence=#bridgehead_4418239020)