Edit: now that I think of it, for generated short lived passwords we also use SSM but for anything set by a human it’s in version control…