One leaked secret bypasses every other control.

Perfect RBAC, perfect network policies, perfect scanning — none of it matters if an attacker simply finds a valid password sitting in plain text.

What actually counts as a secret

DB passwordsAPI keysTLS/SSH private keysEncryption keysOAuth secretsWebhook signing secretsService-to-service tokens

The sins of secret management

Hardcoded in source code
Committed to git (still in history, even "removed")
Baked into a container image layer
Plain env var, visible in process listings
Shared over Slack/email
Never rotated, ever

"removing" a secret from git doesn't remove it

git rm secrets.env && git commit -m "remove secrets"
# the secret is STILL fully recoverable:
git log --all --full-history -- secrets.env
git show <old-commit>:secrets.env

Treat any committed secret as permanently compromised — rotate it, don't just delete the line and move on.