Secrets & Access No secrets in repos • Use CI secrets or offline storage Radio/AP creds stored offline; rotate annually