Credentials are encrypted at rest (AES-256-GCM, env-held key) and NEVER rendered back — only a masked indicator (mandate M6).
not signed in — saving will likely fail with 401. sign in →