64 secrets, 12 systems, 5 categories (API keys, DB passwords, signing keys, SSH keys, OAuth client secrets). Rotation cadence vs policy. The overdue list is what an auditor pulls first.