An internal test obtains a credential from an exposed configuration file. What should the final handover include?

1. The credential stored indefinitely on the tester's personal laptop
2. A statement that deleting the configuration always invalidates the credential
3. Evidence of exposure without unnecessary secret disclosure and a coordinated rotation recommendation
4. The full secret in a publicly shared report