Store secrets in environment variables / a vault in production — not in definitions.

Strings may use {{field}} placeholders resolved from case data.