[security-dev] remove credential?