Secrets that end up somewhere readable

The usual failure is not a broken lock but a key left where anyone could pick it up.

Every site holds things nobody outside should see: credentials for stored information, keys used to talk to other services, the material that makes sessions trustworthy. These are rarely stolen through cleverness. They are far more often simply found, because they were placed somewhere convenient and the convenience outlived the caution. Written into a file that later gets shared. Copied into a message to solve an urgent problem. Recorded in a log because a diagnostic printed everything it had.

The defensive posture follows from that. Keep secrets out of the same place as the ordinary material, so that sharing one does not share the other. Assume anything written to a log may eventually be read by someone unintended, and keep secrets out of logs by design rather than by discipline. Give each secret the smallest scope that still works. Above all, be able to replace one quickly, because the value of a secret you can rotate in minutes is enormously higher than one that would take a week to change.

There is a cultural side that matters as much as the technical one. Treating a possible exposure as embarrassing makes people quiet, and quiet is precisely wrong. The correct response to uncertainty about whether a secret leaked is to replace it, without argument and without blame. If replacement is routine and cheap, that response is easy. If it is painful, people will talk themselves out of it, and that is how a small mistake becomes a long one.