The fetch span and the download span recorded the whole address, so a private feed's credential (Patreon's ?auth=) went to Tempo with every scan, readable by anyone with Grafana. feed::redact drops the query, fragment and user:password; a token in the path would still go, noted where it is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>