diff --git a/server-rs/crates/platform-tripo/src/common/types.rs b/server-rs/crates/platform-tripo/src/common/types.rs
index 1a8144879..5178ac2ec 100644
--- a/server-rs/crates/platform-tripo/src/common/types.rs
+++ b/server-rs/crates/platform-tripo/src/common/types.rs
@@ -43,6 +43,13 @@ impl TripoUrl {
                 message: "URL must use http or https".into(),
             });
         }
+        // 产物地址不需要凭据；userinfo 只会在日志与调试输出里泄漏账号信息，直接拒收。
+        if !url.username().is_empty() || url.password().is_some() {
+            return Err(TripoError::OutputSchema {
+                task_id: "unknown".into(),
+                message: "URL must not contain userinfo".into(),
+            });
+        }
         Ok(Self(url))
     }