diff --git a/graphify/security.py b/graphify/security.py
index 2ed5351c7..0fe0ce7a1 100644
--- a/graphify/security.py
+++ b/graphify/security.py
@@ -115,6 +115,9 @@ def validate_url(url: str) -> str:
             f"Got: {url!r}"
         )
 
+    if parsed.username is not None or parsed.password is not None:
+        raise ValueError(f"Blocked URL containing embedded credentials. Got: {url!r}")
+
     try:
         port = parsed.port
     except ValueError as exc: