A public repository caches a directory containing a private registry credential alongside downloaded dependencies. The team believes a hard-to-guess cache key prevents exposure. What is the correct assessment?

1. An obscure cache key provides the same confidentiality guarantee as a repository secret.
2. Moving the credential into a cached hidden file makes it safe.
3. Cache retention automatically revokes every credential stored in the cache.
4. Exclude credentials from caches and supply them as secrets.