Canonical answer maintained by the knowledge admin. Used by AI drafting to seed RFP draft v1.
AWS Secrets Manager + HashiCorp Vault for application credentials, with automatic rotation. No secrets in source control, enforced by pre-commit hooks and CI scanners.