How does one keep these credentials secure? If its security is not based in the configuration file, we probably don't need to say it here to mislead into thinking that we're somehow securing it here.

We could just say "The secure credentials for our SP"