Using Vault isn't going to make this impossible. The secrets still end up somewhere on a host in an env var. People still get permission at some point to read f

Using Vault isn't going to make this impossible. The secrets still end up somewhere on a host in an env var. People still get permission at some point to read from Vault. Combine enough parts of the puzzle and you can find cracks in the system.