Secrets
Encrypted values scoped to an environment, the services they reach, and the rotation and revocation each one carries.
Application secrets
Readable values exist only while they are entered. What is kept is encrypted material and safe version metadata.
Only a credential or a private value belongs here. Anything a person may read belongs in configuration.
Distribution health
Each active version is acknowledged by its consumer on its own, so a failed delivery is retried without cutting a new version.
Delivery begins when an active version is admitted into a build or a release.
Lifecycle policy
Rotation, break-glass requirements, and recoverable deletion stay attached to each secret.
A secret gets a rotation schedule and a break-glass rule when its first version lands.
A build-time secret is mounted for the build step alone and is left out of the artifact. A runtime secret is delivered by version to the services chosen for it. A value the browser can read is never accepted here.