Secrets in URLs are displayed in plaintext but should be redacted

[zanieb]

e.g.

uv pip install "uv-private-pypackage@git+https://$GITHUB_TOKEN@github.com/astral-test/uv-private-pypackage"
Updating https://github_pat_blaslgmaskgnsaiugbasufbasbfsahufbs/ (github.com/astra
⠙ Resolving dependencies...      

[zanieb]

pip has some inconsistent behavior here

Collecting uv-private-pypackage@ git+https://github_pat_blaslgmaskgnsaiugbasufbasbfsahufbs@github.com/astral-test/uv-private-pypackage
  Cloning https://****@github.com/astral-test/uv-private-pypackage to /private/var/folders/bc/qlsk3t6x7c9fhhbvvcg68k9c0000gp/T/pip-install-ch2lbg94/uv-private-pypackage_4d0cd18db04c42f0bd628080e4bf5722
  Running command git clone --filter=blob:none --quiet 'https://****@github.com/astral-test/uv-private-pypackage' /private/var/folders/bc/qlsk3t6x7c9fhhbvvcg68k9c0000gp/T/pip-install-ch2lbg94/uv-private-pypackage_4d0cd18db04c42f0bd628080e4bf5722

[charliermarsh]

Is it fair to assume that we should always redact the segment preceding the @?

[zanieb]

Probably!