Mask credentials in a URL before it appears in an error message. Defensive:
this client sends credentials in headers (not the query string), but a caller
who overrides the transport or base URL could still put them in the URL, so
any URL surfaced in an error is scrubbed. Two channels are masked:
the username / passwordquery parameters (legacy GENESIS style), and
the URL userinfo component (https://user:pass@host), which Node turns
into a Basic Authorization header — otherwise user:pass@ would leak
verbatim into stderr / CI logs on any error.
Mask credentials in a URL before it appears in an error message. Defensive: this client sends credentials in headers (not the query string), but a caller who overrides the transport or base URL could still put them in the URL, so any URL surfaced in an error is scrubbed. Two channels are masked:
username/passwordquery parameters (legacy GENESIS style), andhttps://user:pass@host), which Node turns into a BasicAuthorizationheader — otherwiseuser:pass@would leak verbatim into stderr / CI logs on any error.