Where container secrets actually leak, and the seven habits that stop it

TL;DR: Environment variables are where most container secrets live, and most leaks are boring: a .env committed to git, a password printed in a log, one key shared across dev and prod. This is the pra