Your Deployment Secrets Live in More Places Than You'd Like to Admit
A little in the CI config. A little in that one script on the jump box. A little in an env file someone scp'd over in 2022. Nobody set out to build it this way — but credential sprawl becomes the quiet normal, one reasonable decision at a time. Here's why the fix is a narrower deployment path, not a new policy doc.