Realistically you’d need to rotate secrets anyway once it moves from dev to production regardless of model provider