pax
d6909bf4d7
The httpx request event hook converts request.url to a str so log_connection can parse it — at that point the credential query params (login, api_key, etc.) are in scope and could be captured by any traceback, debug hook, or monitoring agent observing the hook call. Pipe through redact_url() first so the rendered string never carries the secrets, even transiently. Audit-Ref: SECURITY_AUDIT.md finding #3 Severity: Medium