Almost every data team has a story about a password in the wrong place. It might be an API key pasted into a notebook "just to test something," or a connection string that made it into Git. Sometimes it's a shared credential that nobody dares rotate,...