An application sends customer data to an external service. Which two practices are appropriate? Select TWO.

1. Send only data required for the intended authorized operation
2. Disable service authorization to simplify deployment
3. Use secure transport and protected service credentials
4. Put the service secret in the browser console for troubleshooting