If a CI job has production secrets, any developer with branch-push access can print them. Production deployment credentials exist only inside a protected release environment. That environment triggers after required human reviews pass on the locked main branch.