Inspect more than the visible domain
Sensitive values can appear in a path, query parameters, a QR code or a copied configuration file. Hiding only the beginning or the password-labelled field may leave another usable credential visible.
Do not paste the address into an unknown online checker to discover whether it is private. That action can disclose it to the very party you did not intend to trust. Ask through the verified service or developer route when you need help identifying the format.
Understand what HTTPS does and does not do
HTTPS protects the connection between endpoints when it is correctly established. It does not make an address safe to publish in a forum, shared document, browser history or screenshot. OWASP documents several ways sensitive URL values can be retained or exposed.
A shortened link is not a redaction. It can still lead to the original private address. Likewise, putting the URL behind a QR code changes its presentation, not the sensitivity of the destination.
Respond if an address was exposed
Remove the public copy where you can, but do not assume removal retracts every copy. Contact the actual service through its verified route about replacing or revoking the exposed access details if that feature is available.
Record when and where the exposure occurred without forwarding the credential to more people. A password or token change is a separate account action; do not assume reinstalling the player automatically invalidates the old address.
Questions about this guide
Is a shortened playlist link safe to post?
No. It can still reveal or lead to private access details.
Does uninstalling the player revoke a leaked URL?
Not necessarily. Ask the actual service how account credentials or tokens can be replaced or revoked.