Sensitive secrets that suffer from over-billing or unauthorized access must be transmitted to the application.

Access to the service must be exposed through an API and implement proper access control and rate-limiting.
