Development record

gitutil.ScrubURLCredentials, which abcd land and the build loop apply to git and forge text they print, finds URLs with a regex whose authority ends at the first slash: a password containing a raw slash (https://u:p/w@host/x) is left unscrubbed, and a query holding an at sign (https://host?q=a@b) is over-redacted to https://b. Git percent-encodes such characters in URLs it prints, so the leak needs a hand-written URL, and over-redaction only garbles a message. Route exists without abcd: no, the scrubber is abcd's, so abcd fixes it. Found by the round 3 reviewers of the abcd land change, 2026-10-15.