CREDENTIAL_FIELD_EXEMPTIONS

@forge/monorepo / backend/src / CREDENTIAL_FIELD_EXEMPTIONS

Variable: CREDENTIAL_FIELD_EXEMPTIONS

const CREDENTIAL_FIELD_EXEMPTIONS: readonly object[]

Defined in: backend/src/security/checklist.ts:220

Source files permitted to declare a secret-shaped field, each with the reason.

The audit scans the whole shipped tree for a field that could hold a secret value, because the guarantee worth having is "a new apiKey cannot be added without this failing" rather than "today's types are clean". A provider credential has to exist somewhere in memory to authenticate, so the honest answer is an exemption with a written constraint — not a narrower scan that would also stop noticing the next real one.

Same shape as RLS_EXEMPT_TABLES, for the same reason: a silent hole in a gate is indistinguishable from a forgotten case.