GPG secrets—private keys used for encryption, signing, and verification—are often buried in repositories, CI/CD pipelines, or configuration files. The moment they appear in code, even for a second, they can be cloned, cached, and exploited. Version control history won’t save you. Deletion won’t save you.