As file.managed and other file. states methods allow to control if it's acceptable to show the changes in the job logs, we need to ensure every configuration file with credentials contain the following:

show_changes: False

e.g. /srv/notifications/storage/app/credentials.json