"Don't hardcode secrets in your code" is a rule every developer learns on day one, but nobody explains clearly where to actually put them. Environment variables leak on process dumps. Config files require git exclusions. Once a secret escapes, you must change it simultaneously across every server — an operational nightmare. Real security teams go further: "not only prevent leaks, but auto-rotate periodically." Nobody changes a DB password by hand every 90 days — nobody bothers because it's tedious. AWS Secrets Manager and SSM Parameter Store address "secrets outside code, auto-rotated when possible" with two different weight classes.
In DVA-C02, these two are almost always compared