externalized security credentials from flow