NuGet.Config package source credentials across project user and machine layers

Configure package source credentials in a user-level NuGet.Config so private feeds are accessible without committing secrets to source-controlled project files.

NuGet merges package sources and packageSourceCredentials from project, user, and machine configuration layers. Credentials stored directly under packageSourceCredentials are plain text and are not encrypted by NuGet. Credential provider support is optional and depends on the NuGet client version. Package source mapping binds package name patterns to specific feeds, but enforcement varies across clients and IDE integrations. It is unclear how project-level mapping interacts with credentials defined in user or machine files when the same feed name appears in multiple layers.

Does project-level packageSourceMapping override user and machine source lists for matching packages, and is that behavior consistent between dotnet CLI and legacy clients? Is a credential provider required to keep user or machine-level packageSourceCredentials out of a project restore that should remain credential-free? How is fallback to nuget.org prevented when mapping is present but not enforced by the client?