diff --git a/CHANGELOG.md b/CHANGELOG.md
index 567c5f7..446716b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `-h` alias for `--help` option [#172](https://github.com/scanapi/scanapi/pull/172)
 - Test results to report [#177](https://github.com/scanapi/scanapi/pull/177)
 - Add test errors to the report [#187](https://github.com/scanapi/scanapi/pull/187)
+- Hides sensitive info in URL [#185](https://github.com/scanapi/scanapi/pull/185)
 
 ### Changed
 - Unified keys validation in a single method [#151](https://github.com/scanapi/scanapi/pull/151)
diff --git a/scanapi/hide_utils.py b/scanapi/hide_utils.py
new file mode 100644
index 0000000..25a1572
--- /dev/null
+++ b/scanapi/hide_utils.py
@@ -0,0 +1,41 @@
+from scanapi.settings import settings
+
+HEADERS = "headers"
+BODY = "body"
+URL = "url"
+
+ALLOWED_ATTRS_TO_HIDE = (HEADERS, BODY, URL)
+SENSITIVE_INFO_SUBSTITUTION_FLAG = "SENSITIVE_INFORMATION"
+
+
+def hide_sensitive_info(response):
+    report_settings = settings.get("report", {})
+    request = response.request
+    request_settings = report_settings.get("hide-request", {})
+    response_settings = report_settings.get("hide-response", {})
+
+    _hide(request, request_settings)
+    _hide(response, response_settings)
+
+
+def _hide(http_msg, hide_settings):
+    for http_attr in hide_settings:
+        secret_fields = hide_settings[http_attr]
+        for field in secret_fields:
+            _override_info(http_msg, http_attr, field)
+
+
+def _override_info(http_msg, http_attr, secret_field):
+    if (
+        secret_field in getattr(http_msg, http_attr)
+        and http_attr in ALLOWED_ATTRS_TO_HIDE
+    ):
+        if http_attr == URL:
+            new_url = getattr(http_msg, http_attr).replace(
+                secret_field, SENSITIVE_INFO_SUBSTITUTION_FLAG
+            )
+            setattr(http_msg, http_attr, new_url)
+        else:
+            getattr(http_msg, http_attr)[
+                secret_field
+            ] = SENSITIVE_INFO_SUBSTITUTION_FLAG
diff --git a/scanapi/tree/request_node.py b/scanapi/tree/request_node.py
index 7ae0ab8..6e04786 100644
--- a/scanapi/tree/request_node.py
+++ b/scanapi/tree/request_node.py
@@ -15,7 +15,8 @@ from scanapi.tree.tree_keys import (
     TESTS_KEY,
     VARS_KEY,
 )
-from scanapi.utils import join_urls, hide_sensitive_info, validate_keys
+from scanapi.utils import join_urls, validate_keys
+from scanapi.hide_utils import hide_sensitive_info
 
 logger = logging.getLogger(__name__)
 
diff --git a/scanapi/utils.py b/scanapi/utils.py
index 67b5e95..ad53343 100644
--- a/scanapi/utils.py
+++ b/scanapi/utils.py
@@ -1,7 +1,4 @@
 from scanapi.errors import InvalidKeyError, MissingMandatoryKeyError
-from scanapi.settings import settings
-
-ALLOWED_ATTRS_TO_HIDE = ("headers body").split()
 
 
 def join_urls(first_url, second_url):
@@ -22,16 +19,6 @@ def validate_keys(keys, available_keys, required_keys, scope):
     _validate_required_keys(keys, required_keys, scope)
 
 
-def hide_sensitive_info(response):
-    report_settings = settings.get("report", {})
-    request = response.request
-    request_settings = report_settings.get("hide-request", {})
-    response_settings = report_settings.get("hide-response", {})
-
-    _hide(request, request_settings)
-    _hide(response, response_settings)
-
-
 def _validate_allowed_keys(keys, available_keys, scope):
     for key in keys:
         if not key in available_keys:
@@ -42,18 +29,3 @@ def _validate_required_keys(keys, required_keys, scope):
     if not set(required_keys) <= set(keys):
         missing_keys = set(required_keys) - set(keys)
         raise MissingMandatoryKeyError(missing_keys, scope)
-
-
-def _hide(http_msg, hide_settings):
-    for http_attr in hide_settings:
-        secret_fields = hide_settings[http_attr]
-        for field in secret_fields:
-            _override_info(http_msg, http_attr, field)
-
-
-def _override_info(http_msg, http_attr, secret_field):
-    if (
-        secret_field in getattr(http_msg, http_attr)
-        and http_attr in ALLOWED_ATTRS_TO_HIDE
-    ):
-        getattr(http_msg, http_attr)[secret_field] = "SENSITIVE_INFORMATION"

diff --git a/tests/unit/test_hide_utils.py b/tests/unit/test_hide_utils.py
new file mode 100644
index 0000000..44720ab
--- /dev/null
+++ b/tests/unit/test_hide_utils.py
@@ -0,0 +1,109 @@
+import pytest
+import requests
+
+from scanapi.hide_utils import hide_sensitive_info, _hide, _override_info
+
+
+@pytest.fixture
+def response(requests_mock):
+    requests_mock.get("http://test.com", text="data")
+    return requests.get("http://test.com")
+
+
+class TestHideSensitiveInfo:
+    @pytest.fixture
+    def mock__hide(self, mocker):
+        return mocker.patch("scanapi.hide_utils._hide")
+
+    test_data = [
+        ({}, {}, {}),
+        ({"report": {"abc": "def"}}, {}, {}),
+        ({"report": {"hide-request": {"url": ["abc"]}}}, {"url": ["abc"]}, {}),
+        ({"report": {"hide-request": {"headers": ["abc"]}}}, {"headers": ["abc"]}, {}),
+        ({"report": {"hide-response": {"headers": ["abc"]}}}, {}, {"headers": ["abc"]}),
+    ]
+
+    @pytest.mark.parametrize("settings, request_settings, response_settings", test_data)
+    def test_calls__hide(
+        self,
+        settings,
+        request_settings,
+        response_settings,
+        mocker,
+        response,
+        mock__hide,
+    ):
+        mocker.patch("scanapi.hide_utils.settings", settings)
+        hide_sensitive_info(response)
+
+        calls = [
+            mocker.call(response.request, request_settings),
+            mocker.call(response, response_settings),
+        ]
+
+        mock__hide.assert_has_calls(calls)
+
+
+class TestHide:
+    @pytest.fixture
+    def mock__override_info(self, mocker):
+        return mocker.patch("scanapi.hide_utils._override_info")
+
+    test_data = [
+        ({}, []),
+        ({"headers": ["abc", "def"]}, [("headers", "abc"), ("headers", "def")]),
+        ({"headers": ["abc"]}, [("headers", "abc")]),
+        ({"url": ["abc"]}, []),
+    ]
+
+    @pytest.mark.parametrize("settings, calls", test_data)
+    def test_calls__override_info(
+        self, settings, calls, mocker, response, mock__override_info
+    ):
+        _hide(response, settings)
+        calls = [mocker.call(response, call[0], call[1]) for call in calls]
+
+        mock__override_info.assert_has_calls(calls)
+
+
+class TestOverrideInfo:
+    def test_overrides(self, response):
+        response.headers = {"abc": "123"}
+        http_attr = "headers"
+        secret_field = "abc"
+
+        _override_info(response, http_attr, secret_field)
+
+        assert response.headers["abc"] == "SENSITIVE_INFORMATION"
+
+    def test_overrides_sensitive_info_url(self, response):
+        secret_key = "129e8cb2-d19c-51ad-9921-cea329bed7fa"
+        response.url = (
+            f"http://test.com/users/129e8cb2-d19c-51ad-9921-cea329bed7fa/details"
+        )
+        http_attr = "url"
+        secret_field = secret_key
+
+        _override_info(response, http_attr, secret_field)
+
+        assert response.url == "http://test.com/users/SENSITIVE_INFORMATION/details"
+
+    def test_when_http_attr_is_not_allowed(self, response, mocker):
+        mocker.patch("scanapi.hide_utils.ALLOWED_ATTRS_TO_HIDE", ["body"])
+        response.headers = {"abc": "123"}
+        http_attr = "headers"
+        secret_field = "abc"
+
+        _override_info(response, http_attr, secret_field)
+
+        assert response.headers["abc"] == "123"
+
+    def test_when_http_attr_does_not_have_the_field(self, response, mocker):
+        mocker.patch("scanapi.hide_utils.ALLOWED_ATTRS_TO_HIDE", ["body"])
+        response.headers = {"abc": "123"}
+        http_attr = "headers"
+        secret_field = "def"
+
+        _override_info(response, http_attr, secret_field)
+
+        assert response.headers == {"abc": "123"}
diff --git a/tests/unit/test_utils.py b/tests/unit/test_utils.py
index c7c7e05..2e6468a 100644
--- a/tests/unit/test_utils.py
+++ b/tests/unit/test_utils.py
@@ -3,12 +3,10 @@ import requests
 
 from scanapi.errors import InvalidKeyError, MissingMandatoryKeyError
 from scanapi.utils import (
-    _hide,
-    _override_info,
-    hide_sensitive_info,
     join_urls,
     validate_keys,
 )
+from scanapi.hide_utils import hide_sensitive_info, _hide, _override_info
 
 
 @pytest.fixture
@@ -99,88 +97,3 @@ class TestValidateKeys:
             scope = "endpoint"
 
             validate_keys(keys, available_keys, mandatory_keys, scope)
-
-
-class TestHideSensitiveInfo:
-    @pytest.fixture
-    def mock__hide(self, mocker):
-        return mocker.patch("scanapi.utils._hide")
-
-    test_data = [
-        ({}, {}, {}),
-        ({"report": {"abc": "def"}}, {}, {}),
-        ({"report": {"hide-request": {"headers": ["abc"]}}}, {"headers": ["abc"]}, {}),
-        ({"report": {"hide-response": {"headers": ["abc"]}}}, {}, {"headers": ["abc"]}),
-    ]
-
-    @pytest.mark.parametrize("settings, request_settings, response_settings", test_data)
-    def test_calls__hide(
-        self,
-        settings,
-        request_settings,
-        response_settings,
-        mocker,
-        response,
-        mock__hide,
-    ):
-        mocker.patch("scanapi.utils.settings", settings)
-        hide_sensitive_info(response)
-
-        calls = [
-            mocker.call(response.request, request_settings),
-            mocker.call(response, response_settings),
-        ]
-
-        mock__hide.assert_has_calls(calls)
-
-
-class TestHide:
-    @pytest.fixture
-    def mock__override_info(self, mocker):
-        return mocker.patch("scanapi.utils._override_info")
-
-    test_data = [
-        ({}, []),
-        ({"headers": ["abc", "def"]}, [("headers", "abc"), ("headers", "def")]),
-        ({"headers": ["abc"]}, [("headers", "abc")]),
-    ]
-
-    @pytest.mark.parametrize("settings, calls", test_data)
-    def test_calls__override_info(
-        self, settings, calls, mocker, response, mock__override_info
-    ):
-        _hide(response, settings)
-        calls = [mocker.call(response, call[0], call[1]) for call in calls]
-
-        mock__override_info.assert_has_calls(calls)
-
-
-class TestOverrideInfo:
-    def test_overrides(self, response):
-        response.headers = {"abc": "123"}
-        http_attr = "headers"
-        secret_field = "abc"
-
-        _override_info(response, http_attr, secret_field)
-
-        assert response.headers["abc"] == "SENSITIVE_INFORMATION"
-
-    def test_when_http_attr_is_not_allowed(self, response, mocker):
-        mocker.patch("scanapi.utils.ALLOWED_ATTRS_TO_HIDE", ["body"])
-        response.headers = {"abc": "123"}
-        http_attr = "headers"
-        secret_field = "abc"
-
-        _override_info(response, http_attr, secret_field)
-
-        assert response.headers["abc"] == "123"
-
-    def test_when_http_attr_does_not_have_the_field(self, response, mocker):
-        mocker.patch("scanapi.utils.ALLOWED_ATTRS_TO_HIDE", ["body"])
-        response.headers = {"abc": "123"}
-        http_attr = "headers"
-        secret_field = "def"
-
-        _override_info(response, http_attr, secret_field)
-
-        assert response.headers == {"abc": "123"}

Hide tokens and authorization info in the generated report
## Description

Add the possibility to hide tokens and authorization info in the generated report to avoid expose sensitive information via [configuration file](https://github.com/scanapi/scanapi/blob/124983ca0365e4552f7ad56a6f9523a829c6c293/scanapi/settings.py#L5) (usually `.scanapi.yaml`).

Change the sensitive information value to `<sensitive_information>`

Configuration Options:
- `report`
-- `hide-response` or `hide-request`
--- `headers` or `body` or `url`
---- list of keys to hide

Example:
```yaml
report:
  hide-response:
    headers:
      - Authorization
      - api-key
  hide-response:
    body:
      - api-key
```

The logic is implemented inside the [hide_sensitive_info method](https://github.com/scanapi/scanapi/blob/124983ca0365e4552f7ad56a6f9523a829c6c293/scanapi/utils.py#L25)

Example of how this should be rendered in the reports:

![image](https://user-images.githubusercontent.com/2728804/83572730-73d2cf80-a500-11ea-9307-549b9915596d.png)


- [x] header for request
- [x] header for response
- [x] body for request
- [x] body for response
- [ ] url for request
- [ ] url for response
tests/unit/test_hide_utils.py::TestHideSensitiveInfo::test_calls__hide[settings0-request_settings0-response_settings0] tests/unit/test_hide_utils.py::TestHideSensitiveInfo::test_calls__hide[settings1-request_settings1-response_settings1] tests/unit/test_hide_utils.py::TestHideSensitiveInfo::test_calls__hide[settings2-request_settings2-response_settings2] tests/unit/test_hide_utils.py::TestHideSensitiveInfo::test_calls__hide[settings3-request_settings3-response_settings3] tests/unit/test_hide_utils.py::TestHideSensitiveInfo::test_calls__hide[settings4-request_settings4-response_settings4] tests/unit/test_hide_utils.py::TestHide::test_calls__override_info[settings0-calls0] tests/unit/test_hide_utils.py::TestHide::test_calls__override_info[settings1-calls1] tests/unit/test_hide_utils.py::TestHide::test_calls__override_info[settings2-calls2] tests/unit/test_hide_utils.py::TestHide::test_calls__override_info[settings3-calls3] tests/unit/test_hide_utils.py::TestOverrideInfo::test_overrides tests/unit/test_hide_utils.py::TestOverrideInfo::test_overrides_sensitive_info_url tests/unit/test_hide_utils.py::TestOverrideInfo::test_when_http_attr_is_not_allowed tests/unit/test_hide_utils.py::TestOverrideInfo::test_when_http_attr_does_not_have_the_field tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api/-health-http://demo.scanapi.dev/api/health] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api/-/health-http://demo.scanapi.dev/api/health] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api/-/health/-http://demo.scanapi.dev/api/health/] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api-health-http://demo.scanapi.dev/api/health] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api-/health-http://demo.scanapi.dev/api/health] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api-/health/-http://demo.scanapi.dev/api/health/] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[-http://demo.scanapi.dev/api/health/-http://demo.scanapi.dev/api/health/] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[http://demo.scanapi.dev/api/health/--http://demo.scanapi.dev/api/health/] tests/unit/test_utils.py::TestJoinUrls::test_build_url_properly[--] tests/unit/test_utils.py::TestValidateKeys::TestThereIsAnInvalidKey::test_should_raise_an_exception tests/unit/test_utils.py::TestValidateKeys::TestMissingMandatoryKey::test_should_raise_an_exception tests/unit/test_utils.py::TestValidateKeys::TestThereIsNotAnInvalidKeysOrMissingMandotoryKeys::test_should_not_raise_an_exception