From 97e682e867f49864ff81f1b934fb6eeb7aca48f9 Mon Sep 17 00:00:00 2001
From: Amanda Tarafa Mas <atarafamas@google.com>
Date: Fri, 17 Jan 2025 00:53:55 -0800
Subject: [PATCH] docs: Add warning note about user provided credential
 configurations.

Towards b/389125232
---
 Google.Api.Gax.Grpc/ClientBuilderBase.cs | 14 ++++++++++++++
 Google.Api.Gax.Rest/ClientBuilderBase.cs | 14 ++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/Google.Api.Gax.Grpc/ClientBuilderBase.cs b/Google.Api.Gax.Grpc/ClientBuilderBase.cs
index e1591170..23cd795f 100644
--- a/Google.Api.Gax.Grpc/ClientBuilderBase.cs
+++ b/Google.Api.Gax.Grpc/ClientBuilderBase.cs
@@ -118,11 +118,25 @@ public abstract class ClientBuilderBase<TClient>
         /// <summary>
         /// The path to the credentials file to use, or null if credentials are being provided in a different way.
         /// </summary>
+        /// <remarks>
+        /// Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source
+        /// for authentication to Google Cloud, you must validate it before providing it to any Google API or library.
+        /// Providing an unvalidated credential configuration to Google APIs can compromise the security of your
+        /// systems and data. For more information, refer to
+        /// <see href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">Validate credential configurations from external sources</see>.
+        /// </remarks>
         public string CredentialsPath { get; set; }
 
         /// <summary>
         /// The credentials to use as a JSON string, or null if credentials are being provided in a different way.
         /// </summary>
+        /// <remarks>
+        /// Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source
+        /// for authentication to Google Cloud, you must validate it before providing it to any Google API or library.
+        /// Providing an unvalidated credential configuration to Google APIs can compromise the security of your
+        /// systems and data. For more information, refer to
+        /// <see href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">Validate credential configurations from external sources</see>.
+        /// </remarks>
         public string JsonCredentials { get; set; }
 
         /// <summary>
diff --git a/Google.Api.Gax.Rest/ClientBuilderBase.cs b/Google.Api.Gax.Rest/ClientBuilderBase.cs
index a3522b7f..d6a371a5 100644
--- a/Google.Api.Gax.Rest/ClientBuilderBase.cs
+++ b/Google.Api.Gax.Rest/ClientBuilderBase.cs
@@ -27,12 +27,26 @@ public abstract class ClientBuilderBase<TClient>
         /// The path to the credentials file to use, or null if credentials are being provided in a different way.
         /// The resulting credential is automatically scoped with the default scopes for the API.
         /// </summary>
+        /// <remarks>
+        /// Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source
+        /// for authentication to Google Cloud, you must validate it before providing it to any Google API or library.
+        /// Providing an unvalidated credential configuration to Google APIs can compromise the security of your
+        /// systems and data. For more information, refer to
+        /// <see href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">Validate credential configurations from external sources</see>.
+        /// </remarks>
         public string CredentialsPath { get; set; }
 
         /// <summary>
         /// The credentials to use as a JSON string, or null if credentials are being provided in a different way.
         /// The resulting credential is automatically scoped with the default scopes for the API.
         /// </summary>
+        /// <remarks>
+        /// Important: If you accept a credential configuration (credential JSON/File/Stream) from an external source
+        /// for authentication to Google Cloud, you must validate it before providing it to any Google API or library.
+        /// Providing an unvalidated credential configuration to Google APIs can compromise the security of your
+        /// systems and data. For more information, refer to
+        /// <see href="https://cloud.google.com/docs/authentication/external/externally-sourced-credentials">Validate credential configurations from external sources</see>.
+        /// </remarks>
         public string JsonCredentials { get; set; }
 
         /// <summary>