pub const SECRET_FIELD_NAMES: &[&str];
Field names whose presence in profiles.json is a parse-level rejection (§2.5). The locator is the only credential surface; anything that smells like an inline secret is a hard fail.
profiles.json