A team proposes granting list on Secrets while denying get, assuming users cannot read the secret values. What is the key problem?

1. A Secret's base64 encoding prevents users from decoding listed values
2. List can only return the Secret's name and never its data
3. Listing Secrets can return their data, so list permission can expose secret contents
4. RBAC automatically hides all data fields for users without get