What is a common mistake with secrets in containers in Container Security?

Using Dockerfile ENV or COPY to bake production credentials into image layers permanently exposes them. In practice, the value of this concept comes from understanding where it belongs in the architecture, what problem it solves, and what constraints or tradeoffs it introduces.