A build executes pull-request code from external contributors. The production deployment credential is currently available in every build. Which change best limits the risk of untrusted build execution?

1. Mask the credential in the console and assume code cannot use it.
2. Keep production secrets in every build and ask contributors not to print them.
3. Give every pull request administrator privileges to avoid permission failures.
4. Separate untrusted validation from privileged deployment and provide each stage only the permissions and secrets it actually needs.