A remote backend supports encryption, authentication and locking. What is still important?

1. Disable locking to improve collaboration
2. Commit backend credentials directly to version control
3. Restrict state access because snapshots can contain secrets
4. Give every user public read access