The property name itself named a credential (token, apiKey, cookie, ...).
A URL carried a signature, SAS, or token query parameter, or embedded userinfo.
A free-text value matched a credential shape (bearer token, JWT, provider key, ...).
A request-header map was dropped because it is not on the export allowlist.
OAuth/authorization scope, audience, tenant, or grant detail.
A source explicitly marked as not exportable by the plan or the source itself.
A pointer to where the artifact is hosted or published (links, href,
publicationUrl, embedUrl, ...). Not a secret — a claim. An exporter
that cannot tell whether the thing it is exporting was ever persisted or
published must not carry a URL that says it was.
A value could not be represented safely (unserializable, cyclic, over budget).
Why a value was withheld from an export.