Treat a personal playlist URL as a secret when it contains account tokens, a username or a password. Anyone who receives the full address may be able to use it. Share the error and a redacted structure rather than publishing the working link.
Look beyond the visible domain
Credentials can appear after question marks, within the path or inside an opaque token. Hiding only a password field in the player does not hide a playlist URL shown elsewhere. Browser history, clipboard tools and screen recordings may also retain the address.
Create a useful redacted example
Replace account values with obvious placeholders while preserving field names and separators. For example, explaining that an address has username and password parameters is usually enough for a formatting discussion. Do not upload the original playlist file just to show that its name ends in .m3u.
Respond promptly to accidental exposure
Delete a public post where possible and ask the service whether the exposed credentials can be changed. Closing your player does not revoke a leaked link. Afterwards, update the saved account on each of your own devices and remove copies from shared notes.
