Secrets management

A secret's danger is proportional to how many places it exists and how long it lives. Most practice focuses on the first storage decision and ignores rotation and revocation, which is where the real exposure sits — a key nobody has rotated in four years has been on more laptops than anyone can name.

Assume every secret will eventually leak. Design so that when it does, the blast radius is small and the fix is one command.