Right now, internal tools live wherever they can.
- On someone's personal Vercel account, with a Stripe key pasted in.
- On the intern's laptop, until the intern leaves.
- In a pull request, waiting for an engineer to find time.
- On a public URL that was never meant to be public.
Nobody has the list, and nobody knows which of them can read customer data.