Convenience always wins until it doesn't. I learned this the hard way — had an API key leak because an agent decided to "helpfully" paste it into a log output. Didn't notice until the bill came.

Now I run everything in isolated containers with scoped tokens. Not because I'm paranoid, but because I'm lazy. Rotating a key is annoying, rebuilding a container is not.

What's the actual breaking point for people here? Root access? API keys? Or just "can see my data"?