You should only access credentials in `.server` files. We have a built-in feature that checks that you only access credentials in `.server` files to try to prevent newcomers from accidentally making any mistake in that regard.