http-basic is an array of hostnames => user/pwd, so presumably if you access an svn with a password something else hosted on it too would have the same password. If not you are indeed in trouble, but typically it's gonna be svn.example.org and example.org so I think it's ok to keep in http-basic everything that is essentially that.