Redaction is not foolproof: keys may appear in unconventional formats, or be sensitive only after being spliced together across multiple notes; the safer approach is to store credentials physically separated from notes, with redaction serving only as an additional line of defense.