createCredential
@forge/monorepo / backend/src / createCredential
Function: createCredential()
createCredential(
input):Credential
Defined in: backend/src/tools/credentials.ts:105
Builds a credential whose secret is not enumerable — AC-7.
A typed object is far more likely to reach a log line than a bare string was: it gets spread into an error's
details, passed to a structured logger, or serialised into an audit row, and every one of those uses
JSON.stringify or an object spread. So the secret is defined non-enumerably and toJSON/toString/
util.inspect are overridden. credential.token still reads normally; { ...credential },
JSON.stringify(credential) and console.log(credential) do not.
This is defence in depth, not a licence: a caller that reads .token and logs that is still logging a
secret, and no type can stop it.