I think that you are missing a scenario: private (but not necessarily closed source) deployments of open source code. Even if those deployments to AWS or other

I think that you are missing a scenario: private (but not necessarily closed source) deployments of open source code. Even if those deployments to AWS or other cloud environments are only for testing purposes as part of the normal development process of the open source code, there are still opportunities for secrets to leak, and would be even if the cloud platform itself were open source.