Secrets
Encrypted values scoped to an environment, the services they reach, and the rotation and revocation each one carries.
Application secrets
Readable values exist only while they are entered. What is kept is encrypted material and safe version metadata.
Production / This environment only / opaque / 1 exact grant / Ending 9D01
api, Server runtimeDistribution health
Each active version is acknowledged by its consumer on its own, so a failed delivery is retried without cutting a new version.
api / secretversion_skinramp_processor_7 / 1 attempt / 3 days ago
Lifecycle policy
Rotation, break-glass requirements, and recoverable deletion stay attached to each secret.
Rotates every 60 days / Next in 29 days / Recoverable for 14 days / Break-glass
A build-time secret is mounted for the build step alone and is left out of the artifact. A runtime secret is delivered by version to the services chosen for it. A value the browser can read is never accepted here.