Logs, support conversations, and internal workflows can accidentally put credentials into prompts. The model usually does not need the literal secret.
Detect and replace
STRIPE_SECRET_KEY=...
↓
{{STRIPE_API_KEY_1}}Pattern detection is a backstop, not a replacement for secret managers, least privilege, repository scanning, and safe logging.
Separate provider credentials
Provider authorization is different from secret detection inside application content. Keep those concerns separate at the gateway boundary.