diff --git a/oracledesk-stellar/agents/core/config.test.ts b/oracledesk-stellar/agents/core/config.test.ts
index 144c36e..25c5043 100644
--- a/oracledesk-stellar/agents/core/config.test.ts
+++ b/oracledesk-stellar/agents/core/config.test.ts
@@ -4,6 +4,8 @@ import { Keypair, StrKey } from "@stellar/stellar-sdk";
 import {
   AgentConfigError,
   describeConfig,
+  redactConfig,
+  TESTNET_PASSPHRASE,
   loadAgentConfig,
   MAINNET_OPT_IN,
   NETWORKS,
@@ -326,3 +328,10 @@ test("parseTunables validates the same fields without a deployment", () => {
   assert.throws(() => parseTunables({ KELLY_FRACTION: "0" }), AgentConfigError);
   assert.throws(() => parseTunables({ KELLY_FRACTION: "1.1" }), AgentConfigError);
 });
+
+test("passphrase constants and redactConfig alias never expose secrets", async () => {
+  assert.equal(TESTNET_PASSPHRASE, NETWORKS.testnet.passphrase);
+  const cfg = await load(LIVE).run();
+  const redacted = JSON.stringify(redactConfig(cfg));
+  assert.ok(!redacted.includes(AGENT.secret()));
+});
diff --git a/oracledesk-stellar/agents/core/config.ts b/oracledesk-stellar/agents/core/config.ts
index 1e32185..21115a6 100644
--- a/oracledesk-stellar/agents/core/config.ts
+++ b/oracledesk-stellar/agents/core/config.ts
@@ -580,3 +580,9 @@ export function describeConfig(cfg: AgentConfig): Record<string, unknown> {
     maker: { ...maker, defaultSeedStroops: maker.defaultSeedStroops.toString() },
   };
 }
+
+export const TESTNET_PASSPHRASE = NETWORKS.testnet.passphrase;
+export const FUTURENET_PASSPHRASE = NETWORKS.futurenet.passphrase;
+export const LOCAL_PASSPHRASE = NETWORKS.local.passphrase;
+export const MAINNET_PASSPHRASE = NETWORKS.mainnet.passphrase;
+export const redactConfig = describeConfig;