Use the credential mask module to avoid exporting sensitive API keys, passwords and other configuration entries to the config-sync.