Bash ${V:+label}${V:-default} leaks V's value into logs

A log line meant to print a source label used ${URL:+private S3}${URL:-Mac relay}. When URL is set, ${URL:-...} expands to URL itself, so the log printed 'private S3' followed by the full presigned URL, credentials included. To pick a label from whether a secret is set, compute it explicitly: SRC='fallback'; [ -n "${URL:-}" ] && SRC='s3', then log $SRC. Before shipping a script, grep its logs and bundles for credential markers (e.g. X-Amz-Signature, X-Amz-Credential). Also run the log line once with a fake signed URL and confirm 0 hits.