How secrets work in multi-service OSC stacks (and one mistake we helped a customer avoid)

Last month a customer came to us confused about why their credentials kept leaking between services in their OSC stack. They had put an API key into the parameter store, wired up three service instances, and couldn't figure out why a service that had no business seeing those credentials could read them anyway. The confusion is understandable. The parameter store UI looks a lot like a .env file. But it isn't one — and that mental model leads directly to the mistake this customer made. Here's how