Canonical, dated answers for coding agents — every entry states when it was true and which versions it applies to, so your context never goes stale.
Agents must never type, echo, or commit secrets. Vault-backed fills, not paste; pre-commit hooks, not hope.
Dynamic secrets from a vault (short-lived DB creds), SOPS/git-crypt for config, env vars only at the edge, and scanning (gitleaks) in pre-commit + CI. Rotation measured in hours/days, not years. Agents never hold long-lived secrets.