diff --git a/app.py b/app.py
index 85ff6b9..0d44548 100644
--- a/app.py
+++ b/app.py
@@ -66,7 +66,21 @@ def friendly_error(raw, service=""):
     return f"{name} couldn't be reached."
 
 
+_SECRET_PARAM_RE = re.compile(
+    r"(?i)\b(apikey|api_key|token|password)=([^&\s'\")]+)"
+)
+
+
+def redact_secrets(raw):
+    """Strip API keys/tokens out of raw exception text before it's shown in
+    the UI. Some services (SABnzbd, Tautulli) embed the key in the request
+    URL, so it ends up verbatim in requests/urllib3 exception strings.
+    """
+    return _SECRET_PARAM_RE.sub(r"\1=[redacted]", str(raw or ""))
+
+
 app.jinja_env.filters["friendly_error"] = friendly_error
+app.jinja_env.filters["redact_secrets"] = redact_secrets
 app.config["SESSION_COOKIE_PATH"] = "/"
 app.config["SESSION_COOKIE_HTTPONLY"] = True
 app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
diff --git a/templates/dashboard.html b/templates/dashboard.html
index e52ba04..62e290e 100644
--- a/templates/dashboard.html
+++ b/templates/dashboard.html
@@ -980,7 +980,7 @@
     {% if raw %}
     <details class="error-detail">
       <summary>Technical details</summary>
-      <pre>{{ raw }}</pre>
+      <pre>{{ raw | redact_secrets }}</pre>
     </details>
     {% endif %}
   </div>