docs(drivers): a plugin driver's config is its author's to keep free of credentials

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6

Author: claude

content/docs/data-modeling/drivers.mdx

@@ -154,7 +154,10 @@ Two things live **outside** `config`, because they are not driver-specific:
 
 A plugin-contributed driver (`com.vendor.snowflake`) has no contract in this
 repo, so its `config` is left unvalidated rather than judged against a shape the
-platform does not have.
+platform does not have. The platform also does not guess which of its keys hold
+credentials: `config` is stored and served to administrators as written. Keeping
+secrets out of it is the plugin author's responsibility; put the credential in
+the bound secret (`external.credentialsRef`) instead.
 
 <Callout type="info">
 The same schemas are projected to JSON Schema for