hmmmm ok well. our small team has API keys and database passwords scattered around: some in CI variables, some in .env files on servers, and (Im embarrassed to say) a couple committed to a private repo at some point.…