Last month I did something uncomfortable: I spent a Friday afternoon auditing how my team actually handles secrets. Not how we say we handle them. How we actually do it.

I checked Slack history, git logs, CI configs, and local machines. What I found wasn't a disaster — it was worse. It was normal. The kind of normal that every team thinks is fine...