Review how this application obtains credentials, API keys, database connection information, signing keys, and environment-specific configuration. Do not print, copy, rotate, or transmit any secret value.

Classify each setting as safe for source control, local environment configuration, GitHub Actions configuration, an approved encrypted secrets manager, or private interactive entry. Identify tracked files that should be removed from future commits, but do not delete them or rewrite Git history without explicit approval.

Propose a bounded migration plan covering local development, automated tests, GitHub workflows when used, least privilege, rotation, failure behavior, and documentation. Include commands with placeholders only. Require the human to enter credentials through an interactive or approved secret-management workflow.

Wait for approval before making changes or creating cloud resources.