How are credentials and secrets protected?

All credentials and secrets are stored in a dedicated secrets-management vault rather than in application code or config files.