From 6d4afaace8cff33b57a06afa3a70260b37a590a4 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 6 Oct 2026 01:10:24 +0000 Subject: [PATCH] docs(drivers): a plugin driver's config is its author's to keep free of credentials Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6 --- content/docs/data-modeling/drivers.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/docs/data-modeling/drivers.mdx b/content/docs/data-modeling/drivers.mdx index 3cf1a74582b..b525e580afe 100644 --- a/content/docs/data-modeling/drivers.mdx +++ b/content/docs/data-modeling/drivers.mdx @@ -154,7 +154,10 @@ Two things live **outside** `config`, because they are not driver-specific: A plugin-contributed driver (`com.vendor.snowflake`) has no contract in this repo, so its `config` is left unvalidated rather than judged against a shape the -platform does not have. +platform does not have. The platform also does not guess which of its keys hold +credentials: `config` is stored and served to administrators as written. Keeping +secrets out of it is the plugin author's responsibility; put the credential in +the bound secret (`external.credentialsRef`) instead. The same schemas are projected to JSON Schema for