diff --git a/docker-server.mjs b/docker-server.mjs
index ed5e112d7..8b3edbf1f 100644
--- a/docker-server.mjs
+++ b/docker-server.mjs
@@ -408,7 +408,7 @@ async function proxyToUpstream(req, res) {
       if (retryEligible && !res.headersSent && n < proxyRetryAttempts && retryableError) {
         const delay = 250 * 2 ** (n - 1); // 250ms, 500ms, ...
         console.warn(
-          `[gitnexus-web] upstream ${err.code}; retry ${n}/${proxyRetryAttempts - 1} in ${delay}ms`,
+          `[gitnexus-web] upstream ${sanitizeForLog(err.code)}; retry ${n}/${proxyRetryAttempts - 1} in ${delay}ms`,
         );
         setTimeout(() => {
           // The client may have aborted during the backoff window; don't fire a
@@ -418,7 +418,7 @@ async function proxyToUpstream(req, res) {
         }, delay);
         return;
       }
-      console.error('[gitnexus-web] upstream proxy error:', err.message);
+      console.error('[gitnexus-web] upstream proxy error:', sanitizeForLog(err.message));
       failGateway(res, 502, 'Bad gateway');
     });
     if (proxyTimeoutMs > 0) {
@@ -487,7 +487,7 @@ const server = createServer(async (req, res) => {
     }
     // Fire-and-forget, so guard the boundary against unhandledRejection.
     proxyToUpstream(req, res).catch((err) => {
-      console.error('[gitnexus-web] proxy handler crashed:', err?.message ?? err);
+      console.error('[gitnexus-web] proxy handler crashed:', sanitizeForLog(err?.message ?? err));
       failGateway(res, 502, 'Bad gateway');
     });
     return;
diff --git a/docker-server.test.mjs b/docker-server.test.mjs
index 51ac32742..80e742f7e 100644
--- a/docker-server.test.mjs
+++ b/docker-server.test.mjs
@@ -621,8 +621,11 @@ it('serves RENDER_EXTERNAL_URL as the backend origin when GITNEXUS_BACKEND_URL i
     async (port) => {
       const res = await rawGet(port, '/');
       assert.equal(res.status, 200);
-      assert.ok(res.body.includes('window.__GITNEXUS_CONFIG__'));
-      assert.ok(res.body.includes('https://gitnexus-web.onrender.com'));
+      // Assert on the parsed value, not a substring of the page: a bare
+      // includes() would also pass if the URL appeared in a comment.
+      const injected = /window\.__GITNEXUS_CONFIG__=(\{.*?\});/.exec(res.body)?.[1];
+      assert.ok(injected, 'Expected __GITNEXUS_CONFIG__ in response body');
+      assert.equal(JSON.parse(injected).backendUrl, 'https://gitnexus-web.onrender.com');
     },
   );
 });