Cleaning sensitive information returned from a REST API
The solution is clear but seems too complicated for just sanitizing two URLs. Few suggestions:

The test only covers the method cleanUrls and only the expected case. There should be at least one test for each public method with the expected input, plus other tests for edge cases.
Limit the interface of SanitationService by setting internal methods to private. For example cleanDeal.
The name cleanUrls is too general. The result is removing the query parameters from the URLs so a better name might be stripUrlsParams.

My suggestion is to simplify cleanApiKeys like this:
public List&lt;Deal&gt; cleanApiKeys(List&lt;Deal&gt; deals) {
    deals.stream().forEach(deal -&gt; {
        deal.stripUrlsParams();
    });
    return deals;
}

The class Deal will &quot;deal&quot; with its URLs:
public class Deal{
    //...
    public void stripUrlsParams() {
        this.url = this.url == null ? null : url.split(&quot;\\?&quot;)[0];
        this.imageUrl = this.imageUrl == null ? null : imageUrl.split(&quot;\\?&quot;)[0];
    }
}

If for some reason you can't change Deal then add a private method in SanitationService.