How secrets work in multi-service OSC stacks (and one mistake we helped a customer avoid)

Last month a customer came to us confused about why their credentials kept leaking between services in their OSC stack. They had put an API key into the parameter store, wired up three service instances, and couldn't figure out why a service that had no business seeing those credentials could read t