Prevent proxy credentials from leaking in errors, logs, and debug output

[allamiro]

Summary

Ensure proxy usernames and passwords are never exposed in user-facing errors, debug output, logs, stack traces, or diagnostic messages.

Problem

Proxy settings may include sensitive credentials, especially when using $proxy_userpwd in the format username:password. If raw proxy values or cURL errors are displayed or logged, credentials could be accidentally exposed.

Proposed improvement

Add a sanitization helper that masks sensitive proxy values before they are used in any error message, debug output, or log entry.

Examples:

username:password

Should appear as:

***:***

And:

http://user:password@proxy.company.com:8080

Should appear as:

http://***:***@proxy.company.com:8080

Acceptance criteria

• Add a helper function to sanitize proxy URLs and proxy credentials.
• Never echo raw $proxy_userpwd.
• Never log raw $proxy_userpwd.
• Mask credentials before logging proxy-related errors.
• Mask credentials before showing debug information.
• Ensure cURL error messages and request diagnostics do not expose proxy credentials.
• Add comments explaining that proxy credentials must never be printed directly.