A clover-honey frame site still pastes the Key Vault secret’s plaintext value into an App Service application setting. What should the developer do instead?
Select an answer to reveal the explanation.
Short Explanation
App settings can point at the vault; they should not become a second copy of the secret. Use a Key Vault reference or the SDK so the real value stays in Key Vault—Base64 in a setting name is not encryption.
Full Explanation
App Service can resolve Key Vault references so settings inject secrets at runtime without storing the secret value as the setting’s source of truth. Developers may also call the Key Vault SDK directly. Duplicating plaintext into app settings, source control, or public docs defeats vault rotation and access control. Encoding is not a substitute for vault storage.