The message I linked to is from one of the Nabu Casa developers. I don’t see any response that gets around the issues he raised.
I’ll send a reply, I think there are improvements that can be made over the current capability, even if it doesn’t address every point.
My main point is around the security audit not catching this though. Ideally you want to have confidence in that report. Maybe they didn’t look into secret management?