A password variable is marked sensitive. Which statement is correct?

1. The backend automatically receives encryption and access controls
2. The value is automatically removed from every state snapshot
3. Every provider receives only a hash instead
4. Display is redacted, but state may still contain the value