Secrets Management

Supply credentials through the actual host configuration mechanism

Keep credentials outside source control and example output. Use the host environment or secret provider, with distinct accounts and least privilege per environment. A local ignored .env file is a development convenience, not a production secret-management service.

Check the actual configuration parser: a string containing ${env.SECRET_NAME} is not interpolated by every QQQ field automatically. Test missing/rotated credentials without logging values. See configuration.