A secret is a sensitive value, like a password or API key, that grants access and must stay out of normal files and chats. It’s only safe when handled correctly: paste it into a chat, a public repository, or a screenshot, and the access it carries is loose. A secret manager keeps those values out of project files, an environment variable hands one to a program at runtime, and encryption protects it in storage and transit.
A company keycard makes it concrete. It’s small enough to sit in your wallet, but if someone else gets it, they can walk into places they shouldn’t. The danger is the access attached to it, not the plastic.
Why you care
An agent allowed to use a secret can act with everything it grants; a read-only key is very different from an admin key that can delete records. Outside scripts and skills carry supply chain risk and can ask for secrets in ways that look harmless. If you wouldn’t hand a stranger your keycard, don’t hand an unreviewed tool your API keys. If a key leaks, rotate it: the digital version of changing the lock.