Sensitive secrets that suffer from over-billing or unauthorized access risk must be transmitted to the application.

Access to the service must be exposed through an API and must implement proper access-control and rate-limiting.

