Playlist URLs can be credentials
Treat a private playlist URL like a password. The URL may contain a username, password, token or signed query string that grants access even when the playlist file itself looks like ordinary text.
Where secrets appear
https://user:REDACTED@media.example/live https://media.example/live?token=REDACTED https://media.example/get?username=REDACTED&password=REDACTED
Never publish a real example. Screenshots, browser history, support messages, cloud conversion sites, analytics logs and shared documents can all preserve the complete URL.
Safe handling checklist
- Use tools that process the playlist locally and verify the browser makes no upload request.
- Redact the authority and query values before sharing a failing entry.
- Prefer HTTPS; plain HTTP exposes traffic to interception on the network path.
- Store files only where intended applications and users can read them.
- Rotate or revoke the provider credential immediately after accidental disclosure.
- Do not reuse a playlist password for email, device or business accounts.