A secret that never changes stays useful to anyone who ever saw it, including people who have left and bots that scraped a leak. Rotation replaces secrets on a schedule and immediately after a suspected leak. The safe way keeps the old and new secret valid together until every app has switched, then revokes the old one. Changing a password in place breaks every running app, which is why "never revoke first" is the usual interview answer.