A deployment must keep environment-specific database endpoints separate from application code. Secrets require stronger protection than ordinary configuration. Which approach is suitable?

1. Assume every environment must share the same database password forever.
2. Treat all resource descriptions as public secret stores.
3. Use managed configuration for endpoints and an appropriate protected secret mechanism for credentials, scoped by environment.
4. Hard-code production credentials and test endpoints together in the application.