Credentials arrive only from BW_* process env or an env file parsed in pure Go (never sourced, never exec'd); files looser than 0600 are refused before a single byte is read, and errors carry line numbers and key names, never values. Env wins over file, per the porting-notes precedence.