diff --git a/modules/lfs/client.go b/modules/lfs/client.go
index c353ecdad2..b1fba18e81 100644
--- a/modules/lfs/client.go
+++ b/modules/lfs/client.go
@@ -9,6 +9,8 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+
+	"gitea.dev/modules/util"
 )
 
 // DownloadCallback gets called for every requested LFS object to process its content
@@ -24,8 +26,8 @@ type Client interface {
 	Upload(ctx context.Context, objects []Pointer, callback UploadCallback) error
 }
 
-// NewClient creates a LFS client
-func NewClient(endpoint *url.URL, httpTransport *http.Transport) Client {
+// newClient creates a LFS client
+func newClient(endpoint *url.URL, httpTransport *http.Transport) Client {
 	if endpoint.Scheme == "file" {
 		return newFilesystemClient(endpoint)
 	}
@@ -40,7 +42,7 @@ func NewClientFromEndpoint(cloneurl, lfsurl string, httpTransport *http.Transpor
 		if lfsurl != "" {
 			source = lfsurl
 		}
-		return nil, fmt.Errorf("unable to determine LFS endpoint from %q", source)
+		return nil, fmt.Errorf("unable to determine LFS endpoint from %q", util.SanitizeCredentialURLs(source))
 	}
-	return NewClient(endpoint, httpTransport), nil
+	return newClient(endpoint, httpTransport), nil
 }
diff --git a/modules/lfs/client_test.go b/modules/lfs/client_test.go
index cfdcd84aeb..db6403e07a 100644
--- a/modules/lfs/client_test.go
+++ b/modules/lfs/client_test.go
@@ -12,11 +12,11 @@ import (
 
 func TestNewClient(t *testing.T) {
 	u, _ := url.Parse("file:///test")
-	c := NewClient(u, nil)
+	c := newClient(u, nil)
 	assert.IsType(t, &FilesystemClient{}, c)
 
 	u, _ = url.Parse("https://test.com/lfs")
-	c = NewClient(u, nil)
+	c = newClient(u, nil)
 	assert.IsType(t, &HTTPClient{}, c)
 }
 
diff --git a/services/mirror/mirror_push.go b/services/mirror/mirror_push.go
index 39d8a725ed..5df0c8a066 100644
--- a/services/mirror/mirror_push.go
+++ b/services/mirror/mirror_push.go
@@ -146,7 +146,7 @@ func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 
 			lfsClient, err := lfs.NewClientFromEndpoint(remoteURL.String(), "", migrations.NewMigrationHTTPTransport())
 			if err != nil {
-				return util.SanitizeErrorCredentialURLs(err)
+				return err
 			}
 			if err := pushAllLFSObjects(ctx, gitRepo, lfsClient); err != nil {
 				return util.SanitizeErrorCredentialURLs(err)