diff --git a/oracledesk-stellar/agents/core/config.test.ts b/oracledesk-stellar/agents/core/config.test.ts
index f8ba3a7..e07c051 100644
--- a/oracledesk-stellar/agents/core/config.test.ts
+++ b/oracledesk-stellar/agents/core/config.test.ts
@@ -4,6 +4,8 @@ import { Keypair, StrKey } from "@stellar/stellar-sdk";
 import {
   AgentConfigError,
   describeConfig,
+  redactConfig,
+  TESTNET_PASSPHRASE,
   loadAgentConfig,
   MAINNET_OPT_IN,
   NETWORKS,
@@ -316,3 +318,10 @@ test("parseTunables validates the same fields without a deployment", () => {
   assert.equal(parseTunables({ SLIPPAGE_BPS: "100" }).trading.slippageBps, 100);
   assert.throws(() => parseTunables({ SLIPPAGE_BPS: "1.0" }), AgentConfigError);
 });
+
+test("passphrase constants and redactConfig alias never expose secrets", async () => {
+  assert.equal(TESTNET_PASSPHRASE, NETWORKS.testnet.passphrase);
+  const cfg = await load(LIVE).run();
+  const redacted = JSON.stringify(redactConfig(cfg));
+  assert.ok(!redacted.includes(AGENT.secret()));
+});
diff --git a/oracledesk-stellar/agents/core/config.ts b/oracledesk-stellar/agents/core/config.ts
index b349523..7d474cb 100644
--- a/oracledesk-stellar/agents/core/config.ts
+++ b/oracledesk-stellar/agents/core/config.ts
@@ -542,3 +542,9 @@ export function describeConfig(cfg: AgentConfig): Record<string, unknown> {
     maker: { ...maker, defaultSeedStroops: maker.defaultSeedStroops.toString() },
   };
 }
+
+export const TESTNET_PASSPHRASE = NETWORKS.testnet.passphrase;
+export const FUTURENET_PASSPHRASE = NETWORKS.futurenet.passphrase;
+export const LOCAL_PASSPHRASE = NETWORKS.local.passphrase;
+export const MAINNET_PASSPHRASE = NETWORKS.mainnet.passphrase;
+export const redactConfig = describeConfig;