Secrets, scoped to the app that needs them

One credential per project and environment, issued short-lived and revocable — so a leak stays inside the blast radius it was minted for.