Leaked cloud keys from repos and CI logs are one of the most common causes of real breaches. Secrets management keeps credentials in a secret store, gives each pipeline only the access it needs, and prefers short-lived tokens through OIDC over long-lived keys. Apply it to every credential the pipeline touches, especially production ones. If a key is ever committed, deleting it in a new commit is not enough: revoke and rotate it first.