diff --git a/src/aioproxies/net.py b/src/aioproxies/net.py
index a5f3da4..7e1cf25 100644
--- a/src/aioproxies/net.py
+++ b/src/aioproxies/net.py
@@ -6,11 +6,24 @@ calling a function without it raises a clear error.
 """
 import logging
 from typing import Optional, Union
+from urllib.parse import urlsplit, urlunsplit
 
 from .proxy import Proxy, to_proxy
 
 log = logging.getLogger(__name__)
 
+
+def _safe_url(url: str) -> str:
+    """strip query + fragment from a url for logging - a provider reset url can carry a
+    rotation token in its query/path; this drops the query/fragment (the usual token spot)
+    so the log line can't leak it. falls back to the raw url only if it won't parse"""
+    try:
+        parts = urlsplit(url)
+    except ValueError:
+        return url
+    return urlunsplit((parts.scheme, parts.netloc, parts.path, "", ""))
+
+
 try:
     import aiohttp
 
@@ -55,7 +68,7 @@ async def reset(reset_url: str, *, timeout: float = 15.0) -> bool:
         async with aiohttp.ClientSession(timeout=t) as session:
             async with session.get(reset_url) as resp:
                 ok = resp.status == 200
-                log.info("proxy reset %s -> %s", reset_url, resp.status)
+                log.info("proxy reset %s -> %s", _safe_url(reset_url), resp.status)
                 return ok
     except Exception as exc:
         log.warning("proxy reset failed: %s", exc)