assuring credentials can't be checked in