diff --git a/httpx/__init__.py b/httpx/__init__.py
index dec5cff..c2925d5 100644
--- a/httpx/__init__.py
+++ b/httpx/__init__.py
@@ -1,7 +1,7 @@
 from .__version__ import __description__, __title__, __version__
 from .api import delete, get, head, options, patch, post, put, request
 from .client import AsyncClient, Client
-from .concurrency import AsyncioBackend
+from .concurrency.asyncio import AsyncioBackend
 from .config import (
     USER_AGENT,
     CertTypes,
diff --git a/httpx/client.py b/httpx/client.py
index fd86fb0..ae75f15 100644
--- a/httpx/client.py
+++ b/httpx/client.py
@@ -5,7 +5,7 @@ from types import TracebackType
 import hstspreload
 
 from .auth import HTTPBasicAuth
-from .concurrency import AsyncioBackend
+from .concurrency.asyncio import AsyncioBackend
 from .config import (
     DEFAULT_MAX_REDIRECTS,
     DEFAULT_POOL_LIMITS,
diff --git a/httpx/concurrency/__init__.py b/httpx/concurrency/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/httpx/concurrency.py b/httpx/concurrency/asyncio.py
similarity index 98%
rename from httpx/concurrency.py
rename to httpx/concurrency/asyncio.py
index f1bf585..6c5dc0c 100644
--- a/httpx/concurrency.py
+++ b/httpx/concurrency/asyncio.py
@@ -14,9 +14,9 @@ import ssl
 import typing
 from types import TracebackType
 
-from .config import PoolLimits, TimeoutConfig
-from .exceptions import ConnectTimeout, PoolTimeout, ReadTimeout, WriteTimeout
-from .interfaces import (
+from ..config import PoolLimits, TimeoutConfig
+from ..exceptions import ConnectTimeout, PoolTimeout, ReadTimeout, WriteTimeout
+from ..interfaces import (
     BaseBackgroundManager,
     BasePoolSemaphore,
     BaseReader,
diff --git a/httpx/dispatch/asgi.py b/httpx/dispatch/asgi.py
index 23eebb0..e3b4b0a 100644
--- a/httpx/dispatch/asgi.py
+++ b/httpx/dispatch/asgi.py
@@ -78,7 +78,7 @@ class ASGIDispatch(AsyncDispatcher):
         app_exc = None
         status_code = None
         headers = None
-        response_started = asyncio.Event()
+        response_started_or_failed = asyncio.Event()
         response_body = BodyIterator()
         request_stream = request.stream()
 
@@ -92,19 +92,20 @@ class ASGIDispatch(AsyncDispatcher):
             return {"type": "http.request", "body": body, "more_body": True}
 
         async def send(message: dict) -> None:
-            nonlocal status_code, headers, response_started, response_body, request
+            nonlocal status_code, headers, response_started_or_failed
+            nonlocal response_body, request
 
             if message["type"] == "http.response.start":
                 status_code = message["status"]
                 headers = message.get("headers", [])
-                response_started.set()
+                response_started_or_failed.set()
             elif message["type"] == "http.response.body":
                 body = message.get("body", b"")
                 more_body = message.get("more_body", False)
                 if body and request.method != "HEAD":
                     await response_body.put(body)
                 if not more_body:
-                    await response_body.done()
+                    await response_body.mark_as_done()
 
         async def run_app() -> None:
             nonlocal app, scope, receive, send, app_exc, response_body
@@ -113,7 +114,8 @@ class ASGIDispatch(AsyncDispatcher):
             except Exception as exc:
                 app_exc = exc
             finally:
-                await response_body.done()
+                await response_body.mark_as_done()
+                response_started_or_failed.set()
 
         # Really we'd like to push all `asyncio` logic into concurrency.py,
         # with a standardized interface, so that we can support other event
@@ -122,17 +124,13 @@ class ASGIDispatch(AsyncDispatcher):
         # `ConcurrencyBackend` with the `Client(app=asgi_app)` case.
         loop = asyncio.get_event_loop()
         app_task = loop.create_task(run_app())
-        response_task = loop.create_task(response_started.wait())
 
-        tasks = {app_task, response_task}  # type: typing.Set[asyncio.Task]
-
-        await asyncio.wait(tasks, return_when=asyncio.FIRST_COMPLETED)
+        await response_started_or_failed.wait()
 
         if app_exc is not None and self.raise_app_exceptions:
             raise app_exc
 
-        assert response_started.is_set(), "application did not return a response."
-        assert status_code is not None
+        assert status_code is not None, "application did not return a response."
         assert headers is not None
 
         async def on_close() -> None:
@@ -189,7 +187,7 @@ class BodyIterator:
         """
         await self._queue.put(data)
 
-    async def done(self) -> None:
+    async def mark_as_done(self) -> None:
         """
         Used by the server to signal the end of the response body.
         """
diff --git a/httpx/dispatch/connection.py b/httpx/dispatch/connection.py
index b51fec6..9dda06d 100644
--- a/httpx/dispatch/connection.py
+++ b/httpx/dispatch/connection.py
@@ -1,7 +1,7 @@
 import functools
 import typing
 
-from ..concurrency import AsyncioBackend
+from ..concurrency.asyncio import AsyncioBackend
 from ..config import (
     DEFAULT_TIMEOUT_CONFIG,
     CertTypes,
diff --git a/httpx/dispatch/connection_pool.py b/httpx/dispatch/connection_pool.py
index 3090a9a..33dbd19 100644
--- a/httpx/dispatch/connection_pool.py
+++ b/httpx/dispatch/connection_pool.py
@@ -1,6 +1,6 @@
 import typing
 
-from ..concurrency import AsyncioBackend
+from ..concurrency.asyncio import AsyncioBackend
 from ..config import (
     DEFAULT_POOL_LIMITS,
     DEFAULT_TIMEOUT_CONFIG,
diff --git a/httpx/dispatch/http11.py b/httpx/dispatch/http11.py
index 623ac1d..eff419a 100644
--- a/httpx/dispatch/http11.py
+++ b/httpx/dispatch/http11.py
@@ -2,7 +2,7 @@ import typing
 
 import h11
 
-from ..concurrency import TimeoutFlag
+from ..concurrency.asyncio import TimeoutFlag
 from ..config import TimeoutConfig, TimeoutTypes
 from ..interfaces import BaseReader, BaseWriter, ConcurrencyBackend
 from ..models import AsyncRequest, AsyncResponse
diff --git a/httpx/dispatch/http2.py b/httpx/dispatch/http2.py
index 980b07b..f932598 100644
--- a/httpx/dispatch/http2.py
+++ b/httpx/dispatch/http2.py
@@ -4,7 +4,7 @@ import typing
 import h2.connection
 import h2.events
 
-from ..concurrency import TimeoutFlag
+from ..concurrency.asyncio import TimeoutFlag
 from ..config import TimeoutConfig, TimeoutTypes
 from ..interfaces import BaseReader, BaseWriter, ConcurrencyBackend
 from ..models import AsyncRequest, AsyncResponse
diff --git a/httpx/models.py b/httpx/models.py
index e433320..edb5723 100644
--- a/httpx/models.py
+++ b/httpx/models.py
@@ -210,6 +210,12 @@ class URL:
     def __repr__(self) -> str:
         class_name = self.__class__.__name__
         url_str = str(self)
+        if self._uri_reference.userinfo:
+            url_str = (
+                rfc3986.urlparse(url_str)
+                .copy_with(userinfo=f"{self.username}:[secure]")
+                .unsplit()
+            )
         return f"{class_name}({url_str!r})"
 
 
@@ -489,10 +495,14 @@ class Headers(typing.MutableMapping[str, str]):
         if self.encoding != "ascii":
             encoding_str = f", encoding={self.encoding!r}"
 
-        as_dict = dict(self.items())
-        if len(as_dict) == len(self):
+        sensitive_headers = {"authorization", "proxy-authorization"}
+        as_list = [
+            (k, "[secure]" if k in sensitive_headers else v) for k, v in self.items()
+        ]
+
+        as_dict = dict(as_list)
+        if len(as_dict) == len(as_list):
             return f"{class_name}({as_dict!r}{encoding_str})"
-        as_list = self.items()
         return f"{class_name}({as_list!r}{encoding_str})"
 
 

Concurrency sub-package
Currently, the `concurrency.py` module is actually asyncio-specific. Preparing for alternative concurrency backend support, we should consider spinning it into a `concurrency/asyncio.py`, leaving room for backend-related stuff to go into `concurrency` package.
diff --git a/tests/client/test_auth.py b/tests/client/test_auth.py
index 6cc64a7..725ea56 100644
--- a/tests/client/test_auth.py
+++ b/tests/client/test_auth.py
@@ -2,6 +2,7 @@ import json
 import os
 
 from httpx import (
+    URL,
     AsyncDispatcher,
     AsyncRequest,
     AsyncResponse,
@@ -100,3 +101,20 @@ def test_trust_env_auth():
     assert response.json() == {
         "auth": "Basic ZXhhbXBsZS11c2VybmFtZTpleGFtcGxlLXBhc3N3b3Jk"
     }
+
+
+def test_auth_hidden_url():
+    url = "http://example-username:example-password@example.org/"
+    expected = "URL('http://example-username:[secure]@example.org/')"
+    assert url == URL(url)
+    assert expected == repr(URL(url))
+
+
+def test_auth_hidden_header():
+    url = "https://example.org/"
+    auth = ("example-username", "example-password")
+
+    with Client(dispatch=MockDispatch()) as client:
+        response = client.get(url, auth=auth)
+
+    assert "'authorization': '[secure]'" in str(response.request.headers)

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest
apt-get update apt-get install -y gcc
3.9
test-requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs==25.3.0
brotlipy==0.7.0
certifi==2025.1.31
cffi==1.17.1
chardet==3.0.4
click==8.1.8
coverage==7.8.0
cryptography==44.0.2
exceptiongroup==1.2.2
flake8==7.2.0
flake8-bugbear==24.12.12
flake8-comprehensions==3.16.0
h11==0.8.1
h2==3.2.0
hpack==3.0.0
hstspreload==2025.1.1
-e git+https://github.com/encode/httpx.git@79425b28d092a0e9d2577539a571467395b768c4#egg=httpx
hyperframe==5.2.0
idna==2.10
iniconfig==2.1.0
isort==6.0.1
mccabe==0.7.0
mypy==1.15.0
mypy-extensions==1.0.0
packaging==24.2
pluggy==1.5.0
pycodestyle==2.13.0
pycparser==2.22
pyflakes==3.3.2
pytest==8.3.5
pytest-asyncio==0.26.0
pytest-cov==6.0.0
rfc3986==1.5.0
tomli==2.2.1
trustme==1.2.1
typing_extensions==4.13.0
uvicorn==0.34.0

name: httpx
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - attrs==25.3.0
      - brotlipy==0.7.0
      - certifi==2025.1.31
      - cffi==1.17.1
      - chardet==3.0.4
      - click==8.1.8
      - coverage==7.8.0
      - cryptography==44.0.2
      - exceptiongroup==1.2.2
      - flake8==7.2.0
      - flake8-bugbear==24.12.12
      - flake8-comprehensions==3.16.0
      - h11==0.8.1
      - h2==3.2.0
      - hpack==3.0.0
      - hstspreload==2025.1.1
      - hyperframe==5.2.0
      - idna==2.10
      - iniconfig==2.1.0
      - isort==6.0.1
      - mccabe==0.7.0
      - mypy==1.15.0
      - mypy-extensions==1.0.0
      - packaging==24.2
      - pluggy==1.5.0
      - pycodestyle==2.13.0
      - pycparser==2.22
      - pyflakes==3.3.2
      - pytest==8.3.5
      - pytest-asyncio==0.26.0
      - pytest-cov==6.0.0
      - rfc3986==1.5.0
      - tomli==2.2.1
      - trustme==1.2.1
      - typing-extensions==4.13.0
      - uvicorn==0.34.0
prefix: /opt/conda/envs/httpx

tests/client/test_auth.py::test_auth_hidden_url tests/client/test_auth.py::test_auth_hidden_header
tests/client/test_auth.py::test_basic_auth tests/client/test_auth.py::test_basic_auth_in_url tests/client/test_auth.py::test_basic_auth_on_session tests/client/test_auth.py::test_custom_auth tests/client/test_auth.py::test_netrc_auth tests/client/test_auth.py::test_trust_env_auth
httpx/concurrency.py httpx/__init__.py httpx/client.py httpx/dispatch/connection_pool.py httpx/dispatch/asgi.py httpx/concurrency/__init__.py httpx/dispatch/http11.py httpx/dispatch/connection.py httpx/dispatch/http2.py httpx/models.py
httpx/__init__.py httpx/client.py httpx/dispatch/connection_pool.py httpx/dispatch/asgi.py httpx/concurrency/__init__.py httpx/concurrency/asyncio.py httpx/dispatch/http11.py httpx/dispatch/connection.py httpx/dispatch/http2.py httpx/models.py