exposed credentials