diff --git a/content/docs/data-modeling/drivers.mdx b/content/docs/data-modeling/drivers.mdx
index 3cf1a74582b..b525e580afe 100644
--- a/content/docs/data-modeling/drivers.mdx
+++ b/content/docs/data-modeling/drivers.mdx
@@ -154,7 +154,10 @@ Two things live **outside** `config`, because they are not driver-specific:
 
 A plugin-contributed driver (`com.vendor.snowflake`) has no contract in this
 repo, so its `config` is left unvalidated rather than judged against a shape the
-platform does not have.
+platform does not have. The platform also does not guess which of its keys hold
+credentials: `config` is stored and served to administrators as written. Keeping
+secrets out of it is the plugin author's responsibility; put the credential in
+the bound secret (`external.credentialsRef`) instead.
 
 <Callout type="info">
 The same schemas are projected to JSON Schema for