A CodeBuild project needs an API credential during its build. The credential must not appear in the buildspec or ordinary logs. Which approach is appropriate?

1. Disable all build logs and keep the secret in source indefinitely.
2. Use supported Secrets Manager or Parameter Store references with appropriate build-role access and avoid echoing the value.
3. Put the credential in the public build badge text.
4. Commit the credential as a plaintext buildspec variable.