[security] use SensitiveValue to safely process card number etc.