A developer embeds target credentials as constants in several mapper expressions. What is the better design?

1. Put the same credentials in a public lookup for easy access.
2. Put supported endpoint authentication in the connection's security configuration.
3. Disable target authentication to simplify integration activation.
4. Keep credentials in mappings and log them for every successful invocation.