Every secrets incident I have reviewed had a policy document that prohibited exactly what happened. The policy was not the missing piece.

Make the safe path the fast path

Developers route around friction, not around security. If fetching a database password for local development requires a ticket, an approval and a VPN, the credential will end up in a shared document within a month. Give them a one-command path that works from a laptop and the shared document disappears on its own.

• Short-lived credentials issued on demand beat long-lived ones stored carefully.
• Scan for committed secrets in the pre-commit hook, not only in CI, so the secret never reaches the remote and never needs rotating.
• Rotate on a schedule so that rotation is boring, rehearsed, and not something you first attempt during an incident.