diff --git a/tests/test_security.py b/tests/test_security.py
index 93de72d79..3d9e5e555 100644
--- a/tests/test_security.py
+++ b/tests/test_security.py
@@ -75,6 +75,15 @@ def test_validate_url_rejects_invalid_port(url):
         validate_url(url)
 
 
+@pytest.mark.parametrize("url", [
+    "https://user:secret@example.com/path",
+    "https://user@example.com/path",
+])
+def test_validate_url_rejects_embedded_credentials(url):
+    with pytest.raises(ValueError, match="embedded credentials"):
+        validate_url(url)
+
+
 # ---------------------------------------------------------------------------
 # safe_fetch - scheme and redirect guards (mocked network)
 # ---------------------------------------------------------------------------