Treat access credentials as high-attention operational data: use only when authorised, never publish, and verify public-boundary hygiene.
