diff --git a/public/users/profile.html b/public/users/profile.html
index 2d01c4a..be8e714 100644
--- a/public/users/profile.html
+++ b/public/users/profile.html
@@ -383,7 +383,7 @@ <h3>Link another account</h3>
                       ${c.provider.charAt(0).toUpperCase() + c.provider.slice(1)}
                       ${isCurrent ? '<span class="current-badge">logged in</span>' : ''}
                     </div>
-                    <div style="font-size: 0.8rem; color: #666;">${c.profile_data.email || c.subject_id}</div>
+                    <div style="font-size: 0.8rem; color: #666;">${c.email || c.subject_id}</div>
                   </div>
                 </div>
                 <button class="remove-btn" onclick="removeCredential('${c.provider}')" ${isCurrent || credentials.length === 1 ? 'disabled title="' + (isCurrent ? 'Cannot remove the method you are currently logged in with' : 'Cannot remove your last login method') + '"' : ''}>
diff --git a/src/UserDO.ts b/src/UserDO.ts
index d08034a..56c1ae9 100644
--- a/src/UserDO.ts
+++ b/src/UserDO.ts
@@ -190,7 +190,14 @@ export class UserDO extends DurableObject {
     for (const row of credentialsMapping) {
       const stub = this.env.CREDENTIAL.get(this.env.CREDENTIAL.idFromName(row.provider as string));
       const providerCreds = await stub.list(this.ctx.id.toString());
-      credentials.push(...providerCreds.map((c: any) => ({ provider: row.provider, ...c })));
+      credentials.push(
+        ...providerCreds.map((c: any) => ({
+          provider: row.provider,
+          subject_id: c.subject_id,
+          email: c.profile_data?.email,
+          created_at: c.created_at,
+        })),
+      );
     }
     return credentials;
   }
diff --git a/src/index.ts b/src/index.ts
index e339e57..8233803 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1055,7 +1055,7 @@ function renderCredentialsList(credentials: any[], currentProvider?: string): st
               ${c.provider.charAt(0).toUpperCase() + c.provider.slice(1)}
               ${isCurrent ? '<span class="current-badge">logged in</span>' : ''}
             </div>
-            <div style="font-size: 0.8rem; color: #666;">${c.profile_data?.email || c.subject_id}</div>
+            <div style="font-size: 0.8rem; color: #666;">${c.email || c.subject_id}</div>
           </div>
         </div>
         <button class="remove-btn" onclick="removeCredential('${c.provider}')" ${isCurrent || credentials.length === 1 ? 'disabled title="' + (isCurrent ? 'Cannot remove the method you are currently logged in with' : 'Cannot remove your last login method') + '"' : ''}>
diff --git a/src/schemas/credential.ts b/src/schemas/credential.ts
index 0511fbb..bab9a9c 100644
--- a/src/schemas/credential.ts
+++ b/src/schemas/credential.ts
@@ -5,7 +5,14 @@ export const CredentialSchema = z.object({
   subject_id: z.string(),
 });
 
-export type Credential = z.infer<typeof CredentialSchema>;
+export const PublicCredentialSchema = z.object({
+  provider: z.string(),
+  subject_id: z.string(),
+  email: z.string().optional(),
+  created_at: z.number().optional(),
+});
+
+export type PublicCredential = z.infer<typeof PublicCredentialSchema>;
 
 export const OAuthCredentialSchema = z.object({
   subject_id: z.string(),
diff --git a/test/userdo.spec.ts b/test/userdo.spec.ts
index 05f520c..774f1e2 100644
--- a/test/userdo.spec.ts
+++ b/test/userdo.spec.ts
@@ -66,4 +66,35 @@ describe('UserDO Durable Object', () => {
     expect(memberships[0].role).toBe(role);
     expect(memberships[0].is_current).toBe(1);
   });
+
+  it('should list credentials without exposing sensitive data', async () => {
+    const id = env.USER.newUniqueId();
+    const stub = env.USER.get(id);
+
+    // Mock CredentialDO behavior
+    const googleCredStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName('google'));
+    await googleCredStub.put({
+      user_id: id.toString(),
+      subject_id: 'g123',
+      access_token: 'secret-token',
+      refresh_token: 'secret-refresh',
+      profile_data: { email: 'user@example.com', extra: 'sensitive' },
+    });
+
+    await stub.addCredential('google', 'g123');
+
+    const credentials = await stub.listCredentials();
+    expect(credentials).toHaveLength(1);
+    expect(credentials[0]).toEqual({
+      provider: 'google',
+      subject_id: 'g123',
+      email: 'user@example.com',
+      created_at: expect.any(Number),
+    });
+
+    // Ensure sensitive fields are NOT present
+    expect(credentials[0]).not.toHaveProperty('access_token');
+    expect(credentials[0]).not.toHaveProperty('refresh_token');
+    expect(credentials[0]).not.toHaveProperty('profile_data');
+  });
 });