diff --git a/tests/test_logging.py b/tests/test_logging.py
new file mode 100644
index 0000000..0360a57
--- /dev/null
+++ b/tests/test_logging.py
@@ -0,0 +1,19 @@
+import json
+import logging
+
+from app.logging_config import JsonFormatter, redact_url
+
+
+def test_redact_url_removes_credentials_query_and_fragment():
+    assert redact_url("https://user:pass@example.com:8443/a?token=secret#x") == "https://example.com:8443/a"
+
+
+def test_json_formatter_never_emits_url_secrets():
+    record = logging.LogRecord("test", logging.INFO, "", 0, "event", (), None)
+    record.url = "https://user:pass@example.com/a?token=secret#fragment"
+    record.monitor_id = "123"
+    output = JsonFormatter().format(record)
+    parsed = json.loads(output)
+    assert parsed["url"] == "https://example.com/a"
+    assert "secret" not in output
+    assert "pass" not in output