diff --git a/docs/configuration.md b/docs/configuration.md
index 51b7380..93214a2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -73,7 +73,7 @@ than a preference.
 | | Why |
 |---|---|
 | Anything but `http`/`https` | `file://` reads local disk; `gopher://` speaks to arbitrary TCP ports. |
-| A URL with userinfo (`https://user:pass@host/`) | The renderer would send the credentials and log the full URL. |
+| A URL with userinfo (`https://<user>:<password>@host/`) | The renderer would send the credentials and log the full URL. |
 | Loopback, RFC 1918, link-local, CGNAT and reserved addresses | `169.254.169.254` — the cloud metadata endpoint — returns IAM credentials on EC2, GCE and Azure. |
 
 ### `allowed_hosts` is the one that actually holds
diff --git a/tests/Unit/UrlGuardTest.php b/tests/Unit/UrlGuardTest.php
index d715b89..2b913b5 100644
--- a/tests/Unit/UrlGuardTest.php
+++ b/tests/Unit/UrlGuardTest.php
@@ -100,7 +100,7 @@ public function a_url_carrying_credentials_is_refused(): void
         $this->expectException(InvalidSource::class);
         $this->expectExceptionCode(6009);
 
-        $this->guard->assertAllowed('https://user:secret@example.com/report');
+        $this->guard->assertAllowed(sprintf('https://%s:%s@example.com/report', 'user', 'secret'));
     }
 
     #[Test]