Braze API keys end up in a dozen CI configs and nobody rotates them. Campaign send is one POST.