A log level and a database password are both config, but leaking one is harmless and leaking the other is an incident. Secrets need access control, audit, encryption and rotation that plain config does not. Treat a value as a secret when anyone who reads it could log in, pay or impersonate something. Base64 in a Kubernetes Secret is an encoding, not protection, which is a favourite interview trap.