We take this very seriously.<p>At a high level, our front end servers can write credentials, but never read them.<p>Only the build machines (which are isolated from the public internet) can decrypt and use them... and only for a short duration during a build.<p>A good portion of our infrastructure is built on AWS - where a majority of our team had worked to build services with similar secure environments.