Nine Secrets, One Alias Boundary: The Credential Playbook Across Applications, APIs, and AI Agents

JWTs, API keys, OAuth tokens, session cookies, cloud IAM credentials, SSH keys, database credentials, webhook secrets, and mTLS certs: the documented abuse patterns for each, and what's left standing when one leaks anyway.