Replit secrets and who can read them in Replit

Move credentials into Secrets. Delete them from source and from configuration entries. Rotate anything that was hard-coded or printed. Use production app secrets, under Publishing, when the published app needs different credentials than the editor. Do not rely on a hidden eye icon as the only control for organization members.