Passwords in configuration files, in scripts, in shell history and IN YOUR OWN TERMINAL SCROLLBACK. Where they end up, and how to stop putting them there.
The APPS password is the most valuable credential in an EBS estate, and the estate leaks it in about six places by default.
CONFIGURATION FILES ARE THE FIRST AND THE ONE PEOPLE KNOW ABOUT. Credentials appear in generated configuration, and those files are readable by more accounts than anybody assumes. Check the permissions on your own estate rather than trusting the defaults — a world-readable configuration file is Lesson 9's second finding.
SCRIPTS ARE THE SECOND AND THE WORST, BECAUSE THEY GET COPIED. A password in a shell script is a password in every backup of that file system, in every clone, in every copy somebody took to a laptop, and possibly in a source repository. Module 12 Lesson 2 of the OIC course says the same thing about an integration export, and the mechanism is identical: a secret inside an artefact travels with the artefact.
SHELL HISTORY IS THE THIRD AND THE MOST OVERLOOKED. A password typed on a command line is recorded in a file in a home directory, and it stays there for months. So is a password passed as a command argument — which is worse, because it is also visible in the process list to anybody logged in at the time.
AND YOUR OWN TERMINAL SCROLLBACK IS THE ONE PEOPLE FORGET IS A PLACE AT ALL. A password echoed by a script, printed by a utility, or pasted into a chat window to share with a colleague. Each of those is a copy in a location with no access control at all.
THE PRACTICES THAT STOP IT ARE SMALL AND HABITUAL. Prompt for a password rather than accepting it as an argument. Read it from a file the owner alone can read rather than embedding it. Never echo it back, even redacted — a redaction you have to get right every time is worse than not printing at all.
AND WHEN YOU FIND ONE SOMEWHERE IT SHOULD NOT BE, THE FIX IS ROTATION RATHER THAN DELETION. Removing the file does not un-copy it; the credential has to be assumed exposed — which is Lesson 4, and it is why finding one is a piece of work rather than a tidy-up.