rotation

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

The response differs sharply between a signing key and an encryption key. The scored answer contains use, rotates, revokes trust, assesses what the attacker could forge or read, and repairs what depended on it.

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.