Credentials on basic authentication appear on the path

[orgads]

When using axios:

axios({
  url: 'http://server/path',
  auth: {
    username: 'user',
    password: 's3cr37',
  }
});

The request dependency entry is logged as http://user:s3cr37@server/path, which is unsafe.

So far I found that _getUrlFromRequestOptions calls url.format, which includes the credentials if auth exists.

Is this intended? Is it possible to call url.format with auth stripped?