Credentials an inspect/1 will print.
Ecto's redact: true keeps a field out of inspect/1, and it defaults to
off — so a struct holding a third-party API key prints it in full into
Logger calls, changeset error output, LiveView debug, crash reports and
whatever error reporter is installed. Nothing at the field's definition
site suggests that, and nothing fails when it happens.
The field name is the only available signal for "is this a secret", which
makes this a heuristic — and one of the few places a heuristic is clearly
right, because nobody names a field sendgrid_api_key by accident.