ensuring creds are not public