One secret source, injected at runtime, never on disk

The audit asked where the database password is and there were five answers, all of them true.

where it was:
  .env in the repository history      (from 2016. still there.)
  an ARG in the Dockerfile            (in the image history)
  an environment variable             (in docker inspect)
  the CI settings                     (fine, but a fourth copy)
  a wiki page                         (for the on-call rota)

where it should be:
  one store. injected at runtime. never written to disk.
  everything else reads from there or does not have it.

Enumerating the copies is the first hour and is usually the whole finding — nobody set out to have five, and each one was added by somebody solving a local problem. Consolidating means one place to rotate, which is the property that matters. The history is the awkward one: a secret committed in 2016 is public forever regardless of what happens now, so consolidation and rotation have to happen together.