this is more of a long term question, we don't need to fix it for this PR, unless this represents a real credential that we don't want to be public