• Copernicus username/password are verified using official login(check_credentials_valid=True). That mode performs validation without writing a Toolbox credentials file. Every download verifies again.
• Optional persistence uses QGIS Authentication Manager's encrypted Basic configuration. Only its configuration ID is stored in QSettings. The user manages the QGIS master password. If encrypted storage is disabled or unlock fails, the UI reports that credentials were not saved and uses them for the session only.
• Login fields mask the password. Credentials travel only in an anonymous child stdin pipe, never process arguments, URL parameters, environment variables, request files, logs or exported provenance. Download requests are retained without credentials for Retry.
• The child suppresses upstream stdout/stderr and logging. The parent discards stderr. UI/log events are reconstructed from fixed codes and allowlisted keys; arbitrary provider exception messages are never shown or exported.
• Catalogue/provenance exports scrub sensitive key names, explicit supplied secret values, URL user-info, query strings and fragments. Signed asset URLs therefore lose reusable query tokens. This intentional redaction can make those exported links unsuitable for later access; use official dataset IDs and live Toolbox access.
• TLS verification remains enabled. The child forces the Toolbox SSL-disable flag to False. Package installation uses HTTPS PyPI and wheels only in a private venv, with no shell execution.
• The child removes inherited PYTHONHOME/PYTHONPATH and GDAL/PROJ data overrides so the private environment can use its own binary package resources. HTTP proxy settings may still be needed for institutional networks; proxy values are not logged.
• Logs contain UTC, code, fixed message, stage progress, known dataset key and optional attempt. They omit username, password, layer names, geometry, arbitrary stack traces and provider URLs. Logs are JSON Lines and can be exported during a job; the run log is also saved automatically at completion/failure/cancel.

Python cannot promise secure memory erasure for immutable strings. Secrets necessarily exist in GUI/worker memory while used; the design minimizes their lifetime and clears references when possible. The encrypted authentication database and the operating system remain part of the trust boundary. A compromised local account can inspect processes and files.

ROI geometry in provenance can be sensitive project information even though it is not an authentication secret. Review output files before sharing them. NetCDF scientific attributes are retained except sensitive keys, supplied secret values in text and signed URL query strings, which are scrubbed before export. Numeric attributes, flag arrays and scientific values are preserved. The plugin does not upload ROI data to anyone besides using its geographic bounds for the official data request; polygon masking happens locally.