Hm, we have multiple layers of protection of different kinds there, since defense should always be in depth. First off, I'm pushing the principle that secrets

Hm, we have multiple layers of protection of different kinds there, since defense should always be in depth. First off, I'm pushing the principle that secrets should only be issued, created, stored and distributed by the secret management system, vault in our case. If you never see a secret, and only instruct the automation how to handle it, it is much harder to leak the secret. Ideally, in production, no human should ever need to see or access the secret. Second, you should have good rotation procedures. Something will eventually leak, or someone will leave on bad terms and you need to be able to handle that. This can be simple - an HA infra service can just reload the core credentials from vault and be done, or somewhat harder, e.g. if customers need and use those passwords. And finally, you should have entropy scanners like trufflehog or github scanners as linked in other tools - both in you precommit hooks (so you cannot commit the secret) as well as in your CI & repository host, so someone who disabled the security scanner "because it was annoying" still gets caught. And I guess finally, whiskey for that friday evening someone still manages to leak something important. Some terminations at work have not been fun.