All secrets (API keys, database credentials, certificates) are stored as encrypted strings (SecureString) via AWS SSM Parameter Store, protected by KMS encryption. Distribution to the application happens automatically and encrypted — without manual steps.

Secrets are never stored in source code, committed environment files, or logs. An automatic secret scanner checks every commit in the CI/CD pipeline for accidentally included credentials. At production startup, it validates that no development or test keys are used — the application refuses to start if such keys are detected.

Error reports are automatically cleansed of personal data (PII scrubbing).