The URL reaches the daemon from the management server or from the caller and can
carry userinfo or a token in its query. Both log lines wrote it whole, into the
file that then ships inside the very bundles this uploads.
Reported by CodeRabbit (CWE-532) and cubic on #7514.