Masking and secret prompts match the serialized field name, but the derive records the Rust ident — so a renamed secret field silently renders and prompts in cleartext. Document the constraint on both Config::SECRET_FIELDS and the derive macro until the derive learns to read serde rename attributes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>