uv-redacted

crates/uv-redacted/ defines DisplaySafeUrl, the wrapper uv uses any time it logs or prints a URL that may contain credentials.

Purpose

url::Url::to_string() includes embedded credentials if present (https://user:secret@host/path). That's a footgun in a tool that prints URLs in logs and errors. DisplaySafeUrl redacts secrets while keeping the original URL available for actual HTTP usage.

Key abstractions

• DisplaySafeUrl — wraps a url::Url. Display impl elides any password.
• DisplaySafeUrlRef — the borrowed counterpart.

Recent fixes

The Apr 2026 PR #19146 made pre-signed S3 upload URLs use DisplaySafeUrl in publish verbose output to prevent leaks of long-lived signature parameters.

See also

• uv-auth, uv-publish, uv-client — the big consumers.