Every source is loaded on the server through its official API or public feed. Nothing is substituted when a source is down: it shows as not connected, with the reason. Credentials are read only on the server and never reach the browser.