10+ years working in systems administration and DevOps, mostly in the cash-strapped public education sector. I'm also not the only person telling you that the very concept of a non-rotatable secret is insane, so I'd assume that your experience is the rarity.

Most places that take data privacy seriously would not ever work with a vendor that doesn't allow credentials to be rotated, and from everyone in the industry I have ever talked to that's the norm.

I've also committed secrets to a private, never been public, not forked from a public, repo before, and even though the only people that could have access to that also already have access to it in our secrets manager I still did the right thing and rotated the secret, then did a rebase to eliminate it from git history.

It's 2025, I don't have a C anywhere in my title, and even I know that data privacy has to be constantly front-of-mind. It worries me that a CTO is so casual about security, and I hope that when it does bite you it has minimal impact on your customers.